CVE-2024-21447 Overview
CVE-2024-21447 is a Windows Authentication elevation of privilege vulnerability affecting multiple supported versions of Windows 10, Windows 11, and Windows Server 2022. The flaw is categorized under [CWE-59] Improper Link Resolution Before File Access, commonly known as a link following vulnerability. A local, authenticated attacker with low privileges can leverage the weakness to gain SYSTEM-level access on the target host. Microsoft addressed the issue as part of its April 2024 Patch Tuesday release. The vulnerability requires no user interaction and does not need network access, making it well suited for post-compromise privilege escalation activity.
Critical Impact
A local attacker with standard user rights can escalate to SYSTEM on unpatched Windows endpoints and servers, compromising confidentiality, integrity, and availability of the host.
Affected Products
- Microsoft Windows 10 21H2 and 22H2
- Microsoft Windows 11 21H2, 22H2, and 23H2
- Microsoft Windows Server 2022 and Windows Server 2022 23H2
Discovery Timeline
- 2024-04-09 - CVE-2024-21447 published to the National Vulnerability Database
- 2024-04-09 - Microsoft released a security patch through the April 2024 Security Update Guide
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-21447
Vulnerability Analysis
CVE-2024-21447 resides in the Windows Authentication component and is tracked as an elevation of privilege issue. The Windows Authentication subsystem interacts with files and directories that a low-privileged user can influence. The CWE-59 classification indicates the code fails to safely resolve symbolic links, junctions, or hard links before performing file operations. An attacker who successfully exploits this flaw runs code in the security context of a higher-privileged account. Microsoft did not disclose the specific binary or function in its advisory, and no public proof of concept is available. The EPSS model estimates a 1.37% probability of exploitation within the next 30 days, placing the vulnerability in the 70th percentile.
Root Cause
The root cause is improper link resolution before file access. The vulnerable code path opens or writes to a file whose path can be manipulated by a low-privileged user through a symbolic link, junction, or hard link. Because the operation runs as SYSTEM, the attacker redirects it to a security-sensitive location.
Attack Vector
Exploitation is local and requires an authenticated user with low privileges on the target machine. The attacker plants a link in a location the Authentication component touches, then triggers the operation. Successful exploitation grants SYSTEM privileges, enabling credential theft, persistence, and lateral movement. See the Microsoft Security Update Guide CVE-2024-21447 advisory for vendor context.
No verified public exploit code is available for this vulnerability. Refer to the vendor advisory for the current technical description.
Detection Methods for CVE-2024-21447
Indicators of Compromise
- Creation of symbolic links, NTFS junctions, or hard links in user-writable directories that redirect into %SystemRoot%, %ProgramData%, or other SYSTEM-owned locations.
- Unexpected file writes or DACL changes performed by SYSTEM processes tied to the Windows Authentication component immediately after a low-privileged process activity.
- New services, scheduled tasks, or driver loads originating from a standard user session shortly after suspicious link creation.
Detection Strategies
- Monitor Windows Sysmon Event ID 11 (FileCreate) and Event ID 1 (ProcessCreate) for standard users creating reparse points via mklink /J or programmatic CreateSymbolicLink calls.
- Alert when non-administrative processes trigger SYSTEM writes into protected paths, a common signature of TOCTOU link-following abuse.
- Correlate token elevation events (Event ID 4672) issued to interactive user sessions that had no legitimate elevation path.
Monitoring Recommendations
- Track authentication service anomalies in Windows Security and Application logs following the April 2024 update baseline.
- Ingest endpoint file, process, and registry telemetry into a central data lake to build behavioral baselines for privilege escalation attempts.
- Prioritize monitoring on multi-user servers, Remote Desktop Session Hosts, and shared workstations where local footholds are more likely.
How to Mitigate CVE-2024-21447
Immediate Actions Required
- Apply the April 2024 Microsoft security updates that address CVE-2024-21447 to all affected Windows 10, Windows 11, and Windows Server 2022 systems.
- Prioritize patch deployment on shared and multi-user hosts, including RDS servers, jump boxes, and developer workstations.
- Audit local user accounts and remove unnecessary interactive logon rights to reduce the pool of potential local attackers.
Patch Information
Microsoft published fixed builds for each affected Windows version through the April 9, 2024 security update cycle. Consult the Microsoft Security Update Guide CVE-2024-21447 entry for the specific KB article and build number associated with each supported release.
Workarounds
- No official workaround is published by Microsoft; patching remains the only supported remediation.
- As a compensating control, restrict the ability of non-administrative users to create symbolic links by tightening the SeCreateSymbolicLinkPrivilege user right assignment.
- Enforce application allowlisting and least-privilege policies to limit the ability of attackers to stage exploit tooling on the host.
# Example: verify which principals hold the Create Symbolic Links privilege
# Run from an elevated PowerShell session
secedit /export /cfg C:\Temp\secpol.cfg
Select-String -Path C:\Temp\secpol.cfg -Pattern 'SeCreateSymbolicLinkPrivilege'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
