CVE-2024-20661: Windows 10 1507 MSMQ DOS Vulnerability

CVE-2024-20661 Overview

CVE-2024-20661 is a denial of service vulnerability in Microsoft Message Queuing (MSMQ). The flaw allows unauthenticated network attackers to disrupt the availability of the MSMQ service on affected Windows systems. Microsoft assigned a CVSS score of 7.5 to the vulnerability, reflecting network-based exploitation without privileges or user interaction. The weakness maps to [CWE-476] Null Pointer Dereference and [CWE-400] Uncontrolled Resource Consumption. MSMQ is widely deployed across enterprise Windows environments to support asynchronous communication between distributed applications, making service interruption operationally significant.

Critical Impact

Remote unauthenticated attackers can trigger denial of service against the MSMQ service across all supported Windows client and server releases, disrupting message-dependent applications.

Affected Products

• Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (21H2, 22H2, 23H2)
• Microsoft Windows Server 2008, 2012, 2012 R2, 2016, 2019, 2022

Discovery Timeline

• 2024-01-09 - CVE-2024-20661 published to NVD
• 2024-12-31 - Last updated in NVD database

Technical Details for CVE-2024-20661

Vulnerability Analysis

The vulnerability resides in the Microsoft Message Queuing (MSMQ) service, which handles message delivery between applications over TCP port 1801 and related ports. An attacker can send crafted network traffic to a host with MSMQ enabled and cause the service to enter a denial of service condition. The CWE classification points to two contributing factors: a null pointer dereference [CWE-476] and uncontrolled resource consumption [CWE-400]. Successful exploitation halts message processing without affecting confidentiality or integrity. The EPSS probability of 6.65% places this vulnerability in the 91st percentile for likelihood of exploitation activity, indicating elevated risk relative to typical CVEs.

Root Cause

The root cause involves improper handling of crafted MSMQ protocol messages by the service. When parsing certain malformed input, the service either dereferences a null pointer or consumes resources without proper bounds, terminating the queue manager process or rendering it unresponsive. MSMQ must be explicitly enabled on Windows hosts, but it is commonly installed on application and middleware servers.

Attack Vector

Exploitation requires network access to the MSMQ listener, typically TCP port 1801. No authentication or user interaction is needed. An attacker delivers a malformed protocol message to the service endpoint, causing the process to fail or stop responding. Hosts exposing MSMQ to untrusted networks are at the highest risk, but lateral exploitation from a compromised internal host is also viable.

No public proof-of-concept code or verified exploit examples are available for CVE-2024-20661. Refer to the Microsoft CVE-2024-20661 Advisory for vendor-provided technical context.

Detection Methods for CVE-2024-20661

Indicators of Compromise

• Unexpected termination or restart of the mqsvc.exe (Message Queuing) service process
• Windows Event Log entries indicating MSMQ service crashes or queue manager failures
• Inbound traffic to TCP port 1801 from untrusted or unexpected source addresses
• Application errors from services that rely on MSMQ for messaging

Detection Strategies

• Monitor for repeated service stop/start cycles on the Message Queuing service across Windows hosts
• Correlate network connections to port 1801 with subsequent MSMQ service failures
• Inspect crash dumps of mqsvc.exe for null pointer dereference signatures consistent with [CWE-476]
• Alert on MSMQ-related entries in System and Application event logs at hosts not normally receiving external queue traffic

Monitoring Recommendations

• Inventory all hosts with the MSMQ feature enabled and validate whether the service is required
• Track exposure of port 1801 across internal and perimeter network segments
• Forward MSMQ service and Windows Event Log telemetry to a centralized SIEM for correlation
• Baseline normal MSMQ traffic volume and source addresses to detect anomalous senders

How to Mitigate CVE-2024-20661

Immediate Actions Required

• Apply the January 2024 Microsoft security updates that address CVE-2024-20661 to all affected Windows client and server versions
• Identify and disable the Message Queuing feature on hosts where it is not required
• Restrict inbound access to TCP port 1801 at host and network firewalls to trusted sources only
• Prioritize patching for internet-facing or DMZ-resident hosts running MSMQ

Patch Information

Microsoft released security updates addressing CVE-2024-20661 as part of the January 2024 Patch Tuesday cycle. Patches are available for all supported Windows 10, Windows 11, and Windows Server releases listed in the affected products. Consult the Microsoft CVE-2024-20661 Advisory for KB article numbers specific to each operating system build.

Workarounds

• Disable the Message Queuing Windows feature on hosts that do not require it using Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server
• Block TCP port 1801 at the perimeter and segment MSMQ traffic to a dedicated VLAN with explicit allow-listing
• Limit MSMQ exposure to authenticated, trusted application tiers via Windows Firewall rules scoped to known source addresses

# Check whether the Message Queuing service is running
sc query MSMQ

# Disable the MSMQ feature where not required
Disable-WindowsOptionalFeature -Online -FeatureName MSMQ-Server -NoRestart

# Restrict inbound traffic to TCP 1801 to trusted hosts only
New-NetFirewallRule -DisplayName "Restrict MSMQ 1801" -Direction Inbound -Protocol TCP -LocalPort 1801 -RemoteAddress 10.0.0.0/8 -Action Allow
New-NetFirewallRule -DisplayName "Block MSMQ 1801 Other" -Direction Inbound -Protocol TCP -LocalPort 1801 -Action Block