PoC

Security Advisory

Exploit Proof-of-Concept Released for LDAP CVE-2024-49112

A proof-of-concept (PoC) exploit has been released for a now-patched security flaw impacting Windows Lightweight Directory Access Protocol (LDAP) that could trigger a denial-of-service (DoS) condition. The out-of-bounds reads vulnerability is tracked as CVE-2024-49113 (CVSS score: 7.5).

Summary 

OEM Microsoft 
Severity Critical 
CVSS 9.8 
CVEs CVE-2024-49112 
Exploited in Wild Yes 
Patch/Remediation Available Yes 
Advisory Version 1.1 

Overview 

A critical exploit proof-of-concept (PoC) has been published for a previously disclosed vulnerability, CVE-2024-49112, within the Windows Lightweight Directory Access Protocol (LDAP) service. Dubbed “LDAP Nightmare,” this vulnerability enables Remote Code Execution (RCE) on unpatched Windows Servers, including Domain Controllers (DCs). This vulnerability was originally disclosed during Microsoft’s December 2024 Patch Tuesday.

Its severity, with a CVSS score of 9.8, underscores its significant impact on enterprise environments. Organizations are urged to take immediate remediation steps to prevent exploitation. 

Vulnerability Name CVE ID Product Affected Severity 
Unauthenticated Remote Code Execution in Windows LDAP   CVE-2024-49112   Windows Server   Critical 

Technical Summary 

The exploitation of CVE-2024-49112 involves a zero-click attack leveraging the LDAP protocol to execute arbitrary code or crash Windows Servers by targeting the Local Security Authority Subsystem Service (LSASS). The PoC released by SafeBreach Labs demonstrates how attackers can manipulate LDAP responses to crash or compromise unpatched systems. Key technical details are as follows: 

CVE ID System Affected Vulnerability Details Impact 
CVE-2024-49112  All unpatched versions of Windows Server and Windows 10 and 11  Integer overflow in LDAP-related code allows remote unauthenticated exploitation via crafted RPC and LDAP queries. For exploitation requires only Internet connectivity for DNS interactions, no authentication needed.  RCE or system crash 

Exploit Details: 

  1. An attacker sends a DCE/RPC request to the target server. 
  1. The target queries the attacker’s DNS server for domain information. 
  1. The attacker manipulates NetBIOS and CLDAP responses to redirect the target server to a malicious LDAP server. 
  1. A crafted LDAP referral response crashes LSASS, causing crash and a system reboot 

Remediation: To mitigate the risk posed by these vulnerabilities, it’s essential that organizations apply patches released by Microsoft. In situations where immediate patching is not possible, it’s advised to “implement detections to monitor suspicious CLDAP referral responses.

  • Apply Patches: Immediately deploy Microsoft’s December 2024Patch Tuesday update to affected systems. 
  • Monitor Activity: Implement detection mechanisms for: 
  • Suspicious CLDAP referral responses with malicious values. 
  • Unusual DsrGetDcNameEx2 calls. 
  • Anomalous DNS SRV queries. 
  • Testing: Use the SafeBreach PoC tool from their GitHub repository to assess the effectiveness of the patch, at your own risk. 

Conclusion: 

The release of a PoC for CVE-2024-49112 significantly heightens the risk of exploitation. SafeBreach’s research underscores the vulnerability’s potential to compromise enterprise networks, including complete domain resource control or critical infrastructure disruption. With Microsoft’s patch available, organizations must prioritize patching and deploy monitoring strategies to safeguard against exploitation. For more information, refer to SafeBreach’s GitHub repository and detailed technical findings. 

References: 

Cybersecurity News

Adobe released Security updates Addressing critical ColdFusion vulnerability with (PoC) Exploit code

Adobe released security updates (APSB24-107) addressing an arbitrary file system vulnerability ColdFusion, identified as CVE-2024-53961,  is linked to a path traversal weakness with proof-of-concept (PoC) exploit code.

This could allow attackers to exploit the flaw and gain unauthorized access to arbitrary files on vulnerable servers. 

As per the updates Adobe ColdFusion versions 2023 and 2021 that addressed an arbitrary file proof-of-concept may enable attackers to read arbitrary files on vulnerable servers, potentially leading to unauthorized access and data exposure warns of critical ColdFusion bug with PoC exploit code.

Summary:

“Adobe is aware that CVE-2024-53961 has a known proof-of-concept that could cause an arbitrary file system read,” Adobe earlier gave statement cautioning customers that it assigned a “Priority 1” severity rating to the flaw because it has a “a higher risk of being targeted, by exploit(s) in the wild for a given product version and platform.”

Key findings:

  • The vulnerability, CVE-2024-53961, affects ColdFusion 2021 and 2023.
  • Adobe has provided a patch to address the issue.
  • The vulnerability can potentially lead to unauthorized access and data exposure
  • The flaw has been given a Priority 1 severity rating, the highest possible level, due to its potential for exploitation in the wild.
  • Adobe has highlighted the critical nature of these updates and classified the vulnerability with a CVSS base score of 7.4, signifying a threat to the security of affected systems. 

Adobe has issued advisory

  • Monitor systems for any signs of exploitation.
  • Adobe has provided a patch to address the vulnerability remediation to mitigate the risk of exploitation.
  • Consider implementing file system monitoring and logging to detect and prevent unauthorized file access.

Path traversal weakness in ColdFusion; CVE-2024-53961

What is Path Traversal?

Hackers uses a tactics by Tricking a web application into displaying the contents of a directory that was not on request by user to gain access to sensitive files on a server.

The path traversal weakness in ColdFusion could be exploited by an attacker to perform unauthorized file system reads on affected servers.

This means that an attacker could manipulate file paths to access sensitive files that are otherwise restricted. This kind of vulnerability can lead to exposure of critical system information, unauthorized access and data exposure.

Reference: https://www.bleepingcomputer.com/news/security/adobe-warns-of-critical-coldfusion-bug-with-poc-exploit-code/

Scroll to top