CVE-2024-28907: Windows Server 2022 Privilege Escalation

CVE-2024-28907 Overview

CVE-2024-28907 is an elevation of privilege vulnerability in the Microsoft Brokering File System affecting Windows Server 2022 23H2. The flaw is classified under [CWE-59] (Improper Link Resolution Before File Access, also known as a link-following vulnerability). A local, authenticated attacker who successfully exploits this flaw can gain SYSTEM-level privileges on the host. Microsoft published the advisory on April 9, 2024 as part of its monthly security update cycle.

Critical Impact
Successful exploitation grants an attacker elevated privileges across a security boundary (Scope: Changed), compromising confidentiality, integrity, and availability of the affected host.

Affected Products

Microsoft Windows Server 2022 23H2
Microsoft Brokering File System component
Systems running the pre-patch April 2024 build of Windows Server 2022 23H2

Discovery Timeline

2024-04-09 - CVE-2024-28907 published to the National Vulnerability Database
2024-04-09 - Microsoft releases security update via the Microsoft Security Update Guide
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-28907

Vulnerability Analysis

The vulnerability resides in the Windows Brokering File System, a component that mediates file system operations between sandboxed or lower-privileged processes and system resources. The weakness is a link-following flaw ([CWE-59]), where the broker fails to properly resolve or validate symbolic links, junctions, or hard links before performing privileged file operations. An authenticated local user can abuse this behavior to redirect broker-initiated file operations to arbitrary filesystem locations. The result is privilege escalation from a standard user context to SYSTEM, breaking the security boundary enforced by the broker (Scope: Changed).

Root Cause

The root cause is improper link resolution before file access within the Brokering File System. The broker performs privileged file operations on paths without canonicalizing them or verifying that intermediate path components are not attacker-controlled reparse points. A low-privileged attacker can plant a crafted symbolic link or junction in a predictable path and race the broker into following it. Attack complexity is high because exploitation requires precise timing against the broker's file handling logic.

Attack Vector

Exploitation requires local access and valid low-privilege credentials on the target Windows Server 2022 23H2 host. The attacker crafts filesystem reparse points that redirect broker file operations to targets owned by SYSTEM. Successful exploitation yields arbitrary file write, overwrite, or deletion as SYSTEM, which attackers typically convert into full code execution via DLL hijacking, scheduled task tampering, or service binary replacement. No user interaction is required beyond the attacker's own session. For complete technical details refer to the Microsoft Security Update Guide.

Detection Methods for CVE-2024-28907

Indicators of Compromise

Creation of symbolic links, mount points, or junctions by non-administrative users in directories accessed by the Brokering File System.
Unexpected SYSTEM-owned file writes or overwrites in user-writable directories such as %LOCALAPPDATA% or %TEMP%.
New or modified services, scheduled tasks, or DLLs appearing immediately after suspicious reparse point creation events.

Detection Strategies

Enable Windows object access auditing (Event IDs 4656, 4663, 4670) on sensitive directories and correlate with reparse point creation.
Hunt for low-privileged processes invoking CreateSymbolicLink, DeviceIoControl with FSCTL_SET_REPARSE_POINT, or using tools such as mklink outside normal administrative workflows.
Correlate file broker activity with subsequent privilege escalations by chaining process lineage and token elevation events.

Monitoring Recommendations

Monitor for abnormal child processes spawned under SYSTEM following file broker interaction with user-controlled paths.
Alert on modifications to service binaries, scheduled task definitions, or startup folders by non-administrative users.
Baseline Brokering File System behavior and flag deviations in file open, write, and delete patterns involving reparse points.

How to Mitigate CVE-2024-28907

Immediate Actions Required

Apply the April 2024 Microsoft security update for Windows Server 2022 23H2 referenced in the Microsoft Security Update Guide.
Inventory all Windows Server 2022 23H2 hosts and prioritize patching of multi-tenant, Remote Desktop, and shared-use systems where local users exist.
Restrict interactive and remote local logon rights to trusted administrators where feasible.

Patch Information

Microsoft released a security update addressing CVE-2024-28907 on April 9, 2024. Administrators should install the latest cumulative update for Windows Server 2022 23H2 through Windows Update, WSUS, or Microsoft Update Catalog. Refer to the Microsoft Security Update Guide for KB article references and specific build numbers.

Workarounds

No official vendor workaround exists; patching is the only supported remediation.
Reduce exposure by removing unnecessary local user accounts and enforcing least privilege on servers.
Consider restricting the ability of non-administrators to create symbolic links via the SeCreateSymbolicLinkPrivilege user right assignment.

bash

# Review symbolic link creation privilege assignment on Windows Server
# Export current security policy
secedit /export /cfg C:\secpol.cfg

# Inspect the SeCreateSymbolicLinkPrivilege entry and ensure only Administrators are listed
findstr /i "SeCreateSymbolicLinkPrivilege" C:\secpol.cfg

# Confirm the April 2024 cumulative update is installed
wmic qfe list brief /format:table