CVE-2024-25089: Windows Firewall Control RCE Vulnerability

CVE-2024-25089 Overview

CVE-2024-25089 is a remote code execution vulnerability affecting Malwarebytes Binisoft Windows Firewall Control versions prior to 6.9.9.2. The vulnerability allows remote attackers to execute arbitrary code via gRPC named pipes, potentially leading to complete system compromise.

Critical Impact

Remote attackers can achieve arbitrary code execution without authentication through insecure gRPC named pipe implementation, potentially gaining full control over affected Windows systems.

Affected Products

• Malwarebytes Binisoft Windows Firewall Control versions prior to 6.9.9.2

Discovery Timeline

• 2024-02-04 - CVE-2024-25089 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-25089

Vulnerability Analysis

This vulnerability is classified as Code Injection (CWE-94) and affects the inter-process communication mechanism within Binisoft Windows Firewall Control. The application utilizes gRPC (Google Remote Procedure Call) over named pipes for communication between its components. Due to insufficient access controls and input validation in the named pipe implementation, remote attackers can inject and execute arbitrary code.

Named pipes in Windows provide a mechanism for interprocess communication, but when improperly secured, they can be accessible to remote attackers over the network. In this case, the gRPC named pipe endpoint lacks proper authentication and authorization checks, allowing unauthenticated remote connections. An attacker can craft malicious gRPC requests that, when processed by the vulnerable service, result in arbitrary code execution with the privileges of the Windows Firewall Control service.

Root Cause

The root cause of this vulnerability lies in the insecure implementation of gRPC named pipes within the Windows Firewall Control application. The named pipe endpoint does not properly validate or authenticate incoming connections, and the gRPC message handling lacks sufficient input sanitization. This combination allows attackers to send specially crafted messages that are processed in an unsafe manner, leading to code execution.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to a vulnerable system can connect to the exposed gRPC named pipe endpoint and send malicious payloads. The exploitation process involves:

1. Identifying a system running a vulnerable version of Binisoft Windows Firewall Control
2. Establishing a connection to the gRPC named pipe endpoint
3. Sending crafted gRPC messages that exploit the lack of input validation
4. Achieving arbitrary code execution in the context of the firewall control service

For detailed technical information about this vulnerability, refer to the HackerOne Security Report #2300061.

Detection Methods for CVE-2024-25089

Indicators of Compromise

• Unusual network connections to Windows systems on ports associated with gRPC services
• Unexpected named pipe connections from remote sources to the Windows Firewall Control service
• Anomalous process spawning from the Windows Firewall Control service process
• Signs of lateral movement or privilege escalation following firewall control service activity

Detection Strategies

• Monitor for unauthorized access attempts to named pipes associated with Windows Firewall Control
• Implement network monitoring to detect unusual gRPC traffic patterns targeting endpoint systems
• Deploy endpoint detection rules to identify suspicious parent-child process relationships involving the firewall control service
• Audit installed versions of Binisoft Windows Firewall Control across the environment to identify vulnerable installations

Monitoring Recommendations

• Enable Windows Event logging for named pipe access and monitor for anomalies
• Configure SIEM rules to alert on gRPC traffic from untrusted network segments
• Implement file integrity monitoring on Windows Firewall Control installation directories
• Deploy SentinelOne Singularity to leverage behavioral AI detection for exploitation attempts

How to Mitigate CVE-2024-25089

Immediate Actions Required

• Upgrade Malwarebytes Binisoft Windows Firewall Control to version 6.9.9.2 or later immediately
• Restrict network access to systems running vulnerable versions until patching is complete
• Monitor systems for indicators of compromise if immediate patching is not possible
• Review security logs for evidence of exploitation attempts

Patch Information

Malwarebytes has addressed this vulnerability in Binisoft Windows Firewall Control version 6.9.9.2. Users should update to this version or later to remediate the vulnerability. The changelog documenting this fix is available at the Binisoft Changelog.

Workarounds

• Implement network segmentation to restrict remote access to systems running Windows Firewall Control
• Use host-based firewalls to block unauthorized access to gRPC named pipe ports
• Deploy network-level access controls to limit which systems can communicate with vulnerable endpoints
• Consider temporarily disabling the Windows Firewall Control service if it is not critical and patching cannot be immediately performed

# Verify installed version and upgrade if necessary
# Check current version in Windows Firewall Control About dialog
# Download latest version from official Binisoft website
# Or use package manager if available:
winget upgrade --id Malwarebytes.WindowsFirewallControl