CVE-2023-28232: Windows 10 1507 PPTP RCE Vulnerability

CVE-2023-28232 Overview

CVE-2023-28232 is a remote code execution vulnerability in the Windows Point-to-Point Tunneling Protocol (PPTP) implementation. The flaw affects supported releases of Windows 10, Windows 11, and Windows Server from 2008 through 2022. Microsoft addressed the issue in its April 2023 security updates.

Exploitation requires an attacker to win a race condition on a targeted PPTP server and depends on user interaction. Successful exploitation can lead to arbitrary code execution in the context of the PPTP service, with high impact to confidentiality, integrity, and availability.

Critical Impact
A successful attack against an exposed PPTP endpoint can give a network-based adversary the ability to execute arbitrary code on the server, compromising the host and any tunneled traffic.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 20H2, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2)
Microsoft Windows Server 2008, 2012, 2016, 2019, and 2022

Discovery Timeline

2023-04-11 - CVE-2023-28232 published to NVD and addressed in Microsoft's April 2023 Patch Tuesday
2024-11-21 - Last updated in the NVD database

Technical Details for CVE-2023-28232

Vulnerability Analysis

The vulnerability resides in the Windows PPTP service, which provides legacy VPN tunneling over TCP port 1723 and GRE. The weakness is classified under [CWE-362] as a concurrent execution issue, indicating that the PPTP server mishandles state when multiple operations occur on shared resources without proper synchronization.

An attacker must initiate connections that trigger the race window while a legitimate user action takes place on the server side. Winning the race produces a memory state the service was not designed to handle, leading to code execution in the PPTP process context. The attack complexity is high because timing must be precise and external conditions must align.

The issue impacts both client and server-class Windows builds where the PPTP service is reachable. Hosts that expose PPTP to untrusted networks face the greatest exposure.

Root Cause

The root cause is a race condition [CWE-362] in the PPTP protocol handler. Concurrent processing of tunnel control messages allows an attacker to manipulate shared state during a narrow window, resulting in memory corruption that the service can be coerced into executing.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends crafted PPTP control sequences to a vulnerable server while a user-driven event occurs concurrently. No credentials are required, but the precise timing and required user interaction raise attack complexity.

No public proof-of-concept or in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS exploitation probability remains low.

Because no verified exploit code is available, technical details are described in prose. Refer to the Microsoft Security Update Advisory for vendor-provided details.

Detection Methods for CVE-2023-28232

Indicators of Compromise

Unexpected inbound traffic to TCP port 1723 or GRE (protocol 47) from untrusted networks targeting hosts that should not be exposing PPTP.
Repeated or rapid PPTP control connections from the same source address, particularly with overlapping session identifiers indicative of race-condition probing.
Crashes, restarts, or abnormal termination of the RasPptpe driver or related Remote Access Service components in the Windows Event Log.

Detection Strategies

Monitor host telemetry for unexpected child processes spawned by svchost.exe instances hosting Remote Access Service, which can indicate post-exploitation activity.
Correlate Windows crash and WER reports referencing PPTP components against perimeter logs showing concurrent connection bursts.
Inventory all internet-facing hosts and identify any system listening on TCP 1723; flag legacy systems still offering PPTP as VPN.

Monitoring Recommendations

Enable network flow logging on perimeter devices and alert on any inbound PPTP or GRE traffic to enterprise subnets.
Forward Windows System and Application logs to a centralized SIEM and build rules for Remote Access Service errors and crashes.
Track patch compliance for the April 2023 cumulative updates across all affected Windows and Windows Server SKUs.

How to Mitigate CVE-2023-28232

Immediate Actions Required

Apply the Microsoft April 2023 security updates to all affected Windows 10, Windows 11, and Windows Server systems.
Block inbound TCP 1723 and GRE at the network perimeter unless PPTP is an explicit business requirement.
Identify and decommission PPTP-based VPN services in favor of modern protocols such as IKEv2/IPsec or SSTP.

Patch Information

Microsoft released fixes for CVE-2023-28232 as part of the April 11, 2023 security update cycle. Updates are available for every supported Windows 10, Windows 11, Windows Server 2008 SP2, Windows Server 2008 R2 SP1, Windows Server 2012, 2012 R2, 2016, 2019, and 2022 build through Windows Update, WSUS, and the Microsoft Update Catalog. Refer to the Microsoft Security Update Advisory for KB article references for each platform.

Workarounds

Disable the Routing and Remote Access Service (RemoteAccess) on hosts that do not require it, removing the PPTP attack surface entirely.
Restrict PPTP access using Windows Firewall rules so that only specific trusted source addresses can reach TCP 1723.
Place PPTP servers behind a VPN concentrator or jump host that enforces authentication before exposing the protocol.

bash

# Configuration example: disable Routing and Remote Access on Windows hosts
Set-Service -Name RemoteAccess -StartupType Disabled
Stop-Service -Name RemoteAccess -Force

# Block inbound PPTP at the host firewall
New-NetFirewallRule -DisplayName "Block-Inbound-PPTP" -Direction Inbound -Protocol TCP -LocalPort 1723 -Action Block
New-NetFirewallRule -DisplayName "Block-Inbound-GRE" -Direction Inbound -Protocol 47 -Action Block