CVE-2024-20687: Windows 10 1507 AllJoyn API DOS Flaw

CVE-2024-20687 Overview

CVE-2024-20687 is a denial of service vulnerability in the Microsoft AllJoyn Application Programming Interface (API). The flaw affects multiple supported versions of Windows 10, Windows 11, and Windows Server. An unauthenticated remote attacker can trigger the condition over the network without user interaction. Successful exploitation disrupts the availability of the AllJoyn service, which Windows uses for device-to-device communication on local networks. The vulnerability is associated with an out-of-bounds read condition [CWE-125]. Microsoft addressed the issue through the January 2024 security update.

Critical Impact

Remote attackers can crash the Microsoft AllJoyn service over the network without authentication, disrupting availability on affected Windows endpoints and servers.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
• Microsoft Windows Server 2016, 2019, and 2022

Discovery Timeline

• 2024-01-09 - CVE-2024-20687 published to the National Vulnerability Database (NVD)
• 2024-01-09 - Microsoft releases security update guidance via the Microsoft Security Update Guide
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-20687

Vulnerability Analysis

The vulnerability resides in the Microsoft AllJoyn API, an inter-device communications framework that ships with Windows. AllJoyn enables proximal devices and applications to discover and communicate with one another across a local network. The flaw is categorized as an out-of-bounds read [CWE-125], meaning the affected code path accesses memory outside the boundaries of an intended buffer.

An attacker who reaches the AllJoyn service over the network can send crafted input that triggers the out-of-bounds read. The resulting condition causes a denial of service against the service or the host process. The vulnerability does not expose confidentiality or integrity, but it fully impacts availability of the targeted component. Exploitation requires no privileges and no user interaction.

The EPSS probability for this CVE is 4.932%, placing it in the 89.79th percentile of scored vulnerabilities, which reflects elevated relative exploitation likelihood compared with most CVEs.

Root Cause

The root cause is improper bounds checking inside the AllJoyn API when processing network-supplied input. The code reads beyond the intended buffer length, leading to a memory access fault that terminates the affected service.

Attack Vector

The attack vector is network-based. An adversary on a network path reachable by the AllJoyn service sends specifically crafted traffic to the vulnerable endpoint. Because AllJoyn is designed for local device discovery and communication, attackers on the same broadcast domain or those able to route traffic to the listening service are positioned to trigger the condition.

No verified public proof-of-concept exploit code is available for CVE-2024-20687. Refer to the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2024-20687

Indicators of Compromise

• Unexpected termination or restart of the AllJoyn Router Service (AJRouter) on Windows endpoints
• Windows Error Reporting entries referencing alljoyn.dll or the AllJoyn service process
• Repeated inbound traffic to AllJoyn-related ports from untrusted local network hosts

Detection Strategies

• Monitor Windows Event Log for Service Control Manager events indicating crashes of the AJRouter service
• Inspect network telemetry for anomalous AllJoyn discovery or session traffic patterns originating from unmanaged devices
• Correlate service crash events with preceding inbound network connections to identify probable exploitation attempts

Monitoring Recommendations

• Track patch state of the January 2024 Windows cumulative update across all Windows 10, Windows 11, and Windows Server inventory
• Alert on disabled or unexpectedly stopped AJRouter services that may indicate exploitation or tampering
• Baseline normal AllJoyn traffic in environments where the service is required, and flag deviations

How to Mitigate CVE-2024-20687

Immediate Actions Required

• Apply the Microsoft January 2024 security update to all affected Windows 10, Windows 11, and Windows Server systems
• Inventory assets running the AllJoyn Router Service and prioritize patching for network-exposed hosts
• Restrict inbound network access to AllJoyn services from untrusted network segments using host and perimeter firewalls

Patch Information

Microsoft published the official remediation guidance at the Microsoft Security Update Guide for CVE-2024-20687. Install the corresponding cumulative update for the specific Windows build in the environment. Reboot affected systems to complete patch application.

Workarounds

• Disable the AllJoyn Router Service (AJRouter) on systems that do not require device-to-device discovery functionality
• Use Windows Defender Firewall to block inbound connections to the AllJoyn service on untrusted networks
• Segment IoT and proximal-discovery traffic away from production user and server subnets

# Disable the AllJoyn Router Service on hosts that do not require it
sc.exe config AJRouter start= disabled
sc.exe stop AJRouter