In June 2024, Microsoft revealed a critical vulnerability, CVE-2024-38076, which affects the Windows Remote Desktop Licensing Service. This vulnerability allows attackers to execute code remotely on target systems with minimal effort, potentially leading to full system compromise. In this exclusive post, we will explore what CVE-2024-38076 is, why it matters, how it can be exploited, and how you can protect your systems.

What is CVE-2024-38076?

CVE-2024-38076 is a Remote Code Execution (RCE) vulnerability reported in the Remote Desktop Licensing Service (RD Licensing Service) component of Windows Server. This service is responsible for managing client access licenses (CALs) for devices and users connecting through Remote Desktop Services (RDS).

The vulnerability occurs because the RD Licensing Service improperly handles specially-crafted requests, allowing unauthenticated attackers on the network to execute arbitrary code in the context of the service.

No user interaction required: The flaw can be exploited through malicious network packets.

- Privilege Escalation: Successful exploitation grants the attacker the same privileges as the service itself, which typically runs with high system privileges.

Technical Details

The core of the vulnerability lies in how the RD Licensing Service parses incoming network requests. Security researchers discovered that malformed packets sent to the licensing service port could cause a buffer overflow or memory corruption, leading to code execution.

The vulnerable service typically listens on TCP port 4105.

Proof-of-Concept Snippet

Below is a simplified Python example that sends a malformed packet to the Licensing Service port. This snippet is for educational awareness only and should not be used for unauthorized testing. Actual exploit code may vary and is much more complex.

import socket

TARGET_IP = '192.168.1.5'  # Change to the vulnerable server's IP
TARGET_PORT = 4105         # Default port for RD Licensing Service

# This is a dummy example of a malformed request
malicious_payload = b'\x00' * 2048  # The real exploit would look different

try:
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((TARGET_IP, TARGET_PORT))
    print(f'Sending malicious payload to {TARGET_IP}:{TARGET_PORT}...')
    sock.sendall(malicious_payload)
    sock.close()
    print('Payload sent.')
except Exception as e:
    print(f'Failed to send payload: {e}')

*Note: This PoC does not exploit the bug but shows how easily a payload could be sent for exploitation purposes.*

What Systems Are Affected?

- Windows Server 2016 / 2019 / 2022 with RD Licensing Service installed and running.

Microsoft Security Guide:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38076

NVD record:

https://nvd.nist.gov/vuln/detail/CVE-2024-38076

Security researchers and news

- Huntress Labs analysis
- BleepingComputer coverage

Microsoft has released patches. Install them ASAP.

Windows Update Instructions

Conclusion

CVE-2024-38076 underlines the importance of patching all components of Windows Servers, not just the most visible ones. Given its remote and pre-authentication nature, any unpatched RD Licensing Service can be an easy entry point for hackers.

Patch now and restrict access. As always, only run required services and monitor network connections.

Microsoft's Patch Tuesday June 2024 notes:

https://msrc.microsoft.com/update-guide/releaseNote/2024-Jun

NSA guidance on network hardening:

https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2597061/nsa-cybersecurity-advisory-protecting-windows-networks/


> *If your organization uses RDS Licensing, act immediately! Feel free to share this guide to increase awareness about CVE-2024-38076. For questions, reach out to your IT security provider or Microsoft support.*

Timeline

Published on: 07/09/2024 17:15:42 UTC
Last modified on: 07/18/2024 23:03:31 UTC