.png){kind=logo}
Executive Summary
Date: January 2025
CVE-2024-49112, dubbed "LDAP Nightmare," is a critical remote code execution (RCE) vulnerability impacting Windows Lightweight Directory Access Protocol (LDAP) services. With a CVSS score of 9.8, this vulnerability presents a severe risk to Windows Servers, especially Domain Controllers (DCs). SafeBreach Labs has unveiled the first proof-of-concept (PoC) exploit, illustrating the potential for zero-click exploitation that can incapacitate unpatched Windows Servers.
Technical Information
Vulnerability Details
CVE-2024-49112 is a critical vulnerability identified in the Windows Lightweight Directory Access Protocol (LDAP) services, specifically within the
Exploitation Path
The exploitation process involves several steps. Initially, the attacker sends a DCE/RPC request to the victim server. The victim server then sends a DNS SRV query to the attacker's domain. The attacker responds with its IP address through an NBNS response. Subsequently, the victim becomes an LDAP client and sends a CLDAP request to the attacker's machine. Finally, the attacker sends a CLDAP referral response, causing LSASS to crash.
PoC Exploit
SafeBreach Labs has released a PoC tool that demonstrates this exploit, which is available on their GitHub repository. This PoC can be utilized to test and verify server protection against this vulnerability.
Exploitation in the Wild
Currently, there are no confirmed reports of CVE-2024-49112 being actively exploited in the wild. However, due to its critical nature and the availability of a PoC, organizations should prioritize patching and maintain vigilance for any suspicious activities.
APT Groups using this vulnerability
No specific APT groups have been identified as exploiting CVE-2024-49112. Nevertheless, the vulnerability's potential impact on Domain Controllers makes it an attractive target for advanced persistent threats. Organizations should be vigilant for TTPs related to LDAP exploitation and unauthorized RPC calls.
Affected Product Versions
The vulnerability affects all unpatched versions of Windows Server, including Windows Server 2019 and 2022. Microsoft has released a patch to address this issue, and it is imperative for organizations to apply it immediately.
Workaround and Mitigation
To mitigate the risks associated with CVE-2024-49112, organizations should implement several strategies. First, deploy the Microsoft patch for CVE-2024-49112 as soon as possible. Second, implement network monitoring to detect suspicious CLDAP referral responses, DsrGetDcNameEx2 calls, and DNS SRV queries. Third, enforce access controls by restricting network access to LDAP services and ensuring only trusted devices can communicate with Domain Controllers.
References
For further information, please refer to the following resources: SafeBreach Blog on LDAP Nightmare, GitHub Repository for PoC, and Microsoft Security Response Center.
Rescana is here for you
CVE-2024-49112 represents a significant threat to Windows Server environments, particularly those utilizing Domain Controllers. The availability of a PoC exploit underscores the urgency for organizations to patch affected systems and implement robust monitoring and detection mechanisms. Rescana is committed to supporting our customers in mitigating this and other cybersecurity threats through our Continuous Threat and Exposure Management platform. For further assistance, please contact us at ops@rescana.com.
Comments