CVE-2024-28905: Windows Server 2022 Privilege Escalation Flaw

CVE-2024-28905 Overview

CVE-2024-28905 is an elevation of privilege vulnerability in the Microsoft Brokering File System affecting Windows Server 2022 23H2. The flaw maps to [CWE-269: Improper Privilege Management] and allows a local, authenticated attacker to escalate privileges on an affected host. Successful exploitation yields high impact to confidentiality, integrity, and availability, with a scope change indicating the attacker can affect resources beyond the vulnerable component's security authority. Microsoft addressed the issue through its April 2024 security update cycle.

Critical Impact

A local attacker with low privileges can gain SYSTEM-level access on Windows Server 2022 23H2, enabling full host compromise and lateral movement within the Windows environment.

Affected Products

• Microsoft Windows Server 2022 23H2
• Component: Microsoft Brokering File System
• CPE: cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*

Discovery Timeline

• 2024-04-09 - CVE-2024-28905 published to NVD and addressed in Microsoft's April 2024 Patch Tuesday
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28905

Vulnerability Analysis

The vulnerability resides in the Microsoft Brokering File System, a Windows subsystem that mediates file access between sandboxed or lower-privileged processes and the underlying file system. Improper privilege management within the broker allows a locally authenticated user to perform actions that should be restricted to higher-privileged identities. Because the vulnerability triggers a scope change, exploitation can impact resources controlled by components outside the broker itself, including SYSTEM-owned objects.

The elevated access permits reading, modifying, or deleting protected files and registry data. Attackers can leverage this to install persistent tooling, disable defensive services, or stage follow-on operations against domain-joined assets.

Root Cause

The root cause is improper privilege management [CWE-269] in the brokering file system driver. The component fails to adequately validate the privileges of the calling process when brokering file operations, allowing a low-privileged caller to perform operations in a higher-privileged security context. Microsoft's advisory does not publicly document the exact code path.

Attack Vector

Exploitation requires local access and valid low-privileged credentials on the target host. No user interaction is required. Attack complexity is high, suggesting the attacker must win a race condition or satisfy specific runtime preconditions to trigger the privilege escalation reliably. Remote exploitation over the network is not possible.

No public proof-of-concept exploit code is available for CVE-2024-28905 at the time of writing, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for CVE-2024-28905 for vendor-supplied technical details.

Detection Methods for CVE-2024-28905

Indicators of Compromise

• Unexpected process creation events where a low-integrity or medium-integrity parent spawns a SYSTEM-level child process
• Anomalous file operations on protected paths such as %SystemRoot%\System32, %ProgramData%, or SYSTEM user profile directories originating from non-administrative accounts
• Loading or interaction with brokering file system driver interfaces by unsigned or untrusted user-mode binaries

Detection Strategies

• Monitor Windows Security event IDs 4672 (special privileges assigned) and 4624 (logon type 2/10) correlated with processes started by non-administrative users immediately preceding privilege escalation
• Alert on Sysmon Event ID 1 process creation entries where the integrity level transitions from Medium to System without an intervening authorized elevation (consent.exe, service start)
• Hunt for abnormal handle duplication and token manipulation API calls (NtDuplicateToken, NtImpersonateAnonymousToken) issued by non-system processes

Monitoring Recommendations

• Enable PowerShell script block logging and command-line auditing to capture post-exploitation tooling that typically follows local privilege escalation
• Baseline normal activity for the Windows Brokering File System and alert on deviations in driver load events (Event ID 6) and kernel object access
• Centralize endpoint telemetry into a SIEM or data lake and retain at least 90 days of process, file, and token events to support retroactive hunting

How to Mitigate CVE-2024-28905

Immediate Actions Required

• Apply the Microsoft April 2024 security update for Windows Server 2022 23H2 on all affected hosts without delay
• Inventory Windows Server 2022 23H2 instances across on-premises and cloud workloads and prioritize patching of domain controllers, Tier 0 assets, and multi-tenant hosts
• Restrict interactive and remote logon rights on affected servers to a minimum set of administrators pending patch deployment
• Review account activity on potentially vulnerable hosts for signs of privilege escalation prior to patching

Patch Information

Microsoft released a security update for CVE-2024-28905 as part of the April 2024 Patch Tuesday. Administrators should install the cumulative update for Windows Server 2022 23H2 referenced in the Microsoft Security Update Guide for CVE-2024-28905. Verify successful installation using Get-HotFix or by checking the OS build number against Microsoft's published patched versions.

Workarounds

• No official vendor-supplied workaround is available; patching is the required remediation path
• Enforce the principle of least privilege and remove unnecessary local logon rights to reduce the pool of accounts able to attempt local exploitation
• Enable attack surface reduction rules and credential guard features on Windows Server 2022 23H2 to limit post-exploitation impact

# Verify patch installation on Windows Server 2022 23H2
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10

# Confirm current OS build matches the patched April 2024 build for 23H2
[System.Environment]::OSVersion.Version
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').UBR