CVE-2024-30013: Windows MultiPoint Services RCE Flaw

CVE-2024-30013 Overview

CVE-2024-30013 is a remote code execution vulnerability in Windows MultiPoint Services affecting multiple supported versions of Windows 10, Windows 11, and Windows Server. Microsoft published the advisory on July 9, 2024. The flaw is rooted in a double free condition [CWE-415] within the MultiPoint Services component. An unauthenticated attacker on the network can trigger memory corruption by inducing a user to perform an action. Successful exploitation yields high impact to confidentiality, integrity, and availability on affected hosts.

Critical Impact

Network-reachable exploitation of Windows MultiPoint Services that requires only user interaction can lead to arbitrary code execution on Windows 10, Windows 11, and Windows Server systems.

Affected Products

• Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
• Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• 2024-07-09 - CVE-2024-30013 published to the National Vulnerability Database (NVD)
• 2024-07-09 - Microsoft releases security update guidance for CVE-2024-30013
• 2024-11-21 - Last updated in the NVD database

Technical Details for CVE-2024-30013

Vulnerability Analysis

The vulnerability resides in Windows MultiPoint Services, a Windows role that allows multiple users to share a single computer with independent sessions. Microsoft categorizes the issue as a remote code execution flaw, and the assigned weakness is a double free condition [CWE-415]. Double free vulnerabilities arise when the same memory region is released twice, corrupting heap metadata and enabling attacker-controlled writes during subsequent allocations.

The attack vector is network-based and does not require prior authentication, but the attacker must convince a user to perform an action that initiates the vulnerable code path. Successful exploitation results in arbitrary code execution in the context of the affected service, with high impact to confidentiality, integrity, and availability.

The EPSS probability stands at approximately 2.89%, placing this issue in the 86th percentile of vulnerabilities ranked by likelihood of exploitation activity, although no public proof-of-concept code or in-the-wild exploitation has been confirmed.

Root Cause

The root cause is improper memory management in the MultiPoint Services component, where an internal object reference is released along two separate code paths. Repeated free()-equivalent operations on the same heap chunk corrupt allocator state and create conditions for controlled overwrite of function pointers or virtual table entries.

Attack Vector

An attacker delivers a crafted request or payload to a Windows host where the MultiPoint Services role or related service is reachable. A local user must take an action that triggers processing of the attacker's input. The resulting double free is groomed into a write primitive, leading to code execution in the security context of the vulnerable process. Refer to the Microsoft Security Update for CVE-2024-30013 for vendor-confirmed technical details.

Detection Methods for CVE-2024-30013

Indicators of Compromise

• Unexpected child processes spawning from Windows MultiPoint Services binaries or svchost.exe instances hosting MultiPoint components.
• Abnormal crashes or Watson error reports referencing MultiPoint Services modules, indicating failed exploitation attempts.
• Outbound network connections from MultiPoint Services host processes to unfamiliar IP addresses shortly after inbound session activity.

Detection Strategies

• Monitor Windows Event Logs for service crashes, Application Error events (Event ID 1000), and unexpected restarts of MultiPoint Services on affected systems.
• Correlate inbound network sessions to MultiPoint hosts with subsequent process creation events (Sysmon Event ID 1) that are not part of normal user session activity.
• Apply behavioral identifications for heap corruption patterns and shellcode execution from service host processes.

Monitoring Recommendations

• Inventory all hosts with the MultiPoint Services role enabled and ensure they are forwarding endpoint and security telemetry to a central SIEM or data lake.
• Track patch compliance for Windows 10, Windows 11, and Windows Server builds listed in Microsoft's advisory.
• Alert on anomalous lateral movement originating from MultiPoint hosts, including SMB and RPC traffic to non-standard destinations.

How to Mitigate CVE-2024-30013

Immediate Actions Required

• Apply the July 2024 Microsoft security updates that address CVE-2024-30013 to all affected Windows 10, Windows 11, and Windows Server systems.
• Identify systems with the MultiPoint Services role installed and prioritize them for patching.
• Restrict network exposure of MultiPoint Services to trusted management networks until patches are fully deployed.

Patch Information

Microsoft has released cumulative security updates that remediate this vulnerability across all listed Windows 10, Windows 11, and Windows Server versions. Refer to the Microsoft Security Update for CVE-2024-30013 for the specific KB identifiers and download links matching each supported build.

Workarounds

• Disable the Windows MultiPoint Services role on systems that do not require it, removing the vulnerable attack surface entirely.
• Enforce network segmentation and host-based firewall rules that block inbound connections to MultiPoint Services from untrusted networks.
• Require user awareness controls so end users do not interact with untrusted content delivered through MultiPoint sessions until patches are applied.

# Configuration example: check for the MultiPoint Services role and remove it if not required
Get-WindowsFeature -Name MultiPoint* | Format-Table -AutoSize
Uninstall-WindowsFeature -Name MultiPointServerRole -Restart