CVE-2024-38061 Overview
CVE-2024-38061 is an elevation of privilege vulnerability in the Microsoft Distributed Component Object Model (DCOM) remote cross-session activation mechanism. An authenticated attacker on the network can exploit weak access controls in DCOM activation to elevate privileges across user sessions on affected Windows systems. Microsoft published the advisory on July 9, 2024, covering supported client and server editions of Windows. The weakness maps to [CWE-284] Improper Access Control and affects both interactive and server workloads that expose DCOM interfaces.
Critical Impact
Successful exploitation allows an attacker with low privileges to gain higher-privileged access across sessions, compromising confidentiality, integrity, and availability of the target host.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (21H2, 22H2, 23H2)
- Microsoft Windows Server 2008 R2, 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2
Discovery Timeline
- 2024-07-09 - CVE-2024-38061 published to NVD
- 2024-07-09 - Microsoft releases security update via MSRC advisory
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-38061
Vulnerability Analysis
The vulnerability resides in the DCOM activation service that mediates cross-session object instantiation. DCOM allows components in one process or session to invoke methods on components hosted in another. Improper access control during remote cross-session activation lets a low-privileged authenticated user request activation of a component that runs in a more privileged session context.
Because the flaw is exposed over the network through the DCOM/RPC transport, an attacker with valid credentials can reach the activation interface from a remote host. The activation path fails to correctly enforce session and identity boundaries, resulting in a privileged component performing work on behalf of the caller.
Root Cause
The root cause is improper access control [CWE-284] in the DCOM activation logic that handles cross-session object instantiation. Session and token validation checks do not correctly separate low-privileged callers from higher-privileged target sessions, allowing privilege boundaries to be crossed during activation.
Attack Vector
Exploitation requires network access to the DCOM/RPC endpoints and valid low-privileged credentials. The attack does not require user interaction, but the high attack complexity reflects the need to win specific conditions during the activation sequence. Microsoft's advisory is the authoritative reference for exploitation prerequisites and affected surfaces. See the Microsoft CVE-2024-38061 Advisory for vendor-supplied details.
No public proof-of-concept exploit code is available for this vulnerability, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-38061
Indicators of Compromise
- Unexpected DCOM activation requests from non-administrative user accounts targeting cross-session components on servers or workstations.
- New or anomalous processes spawned by svchost.exe hosting DcomLaunch or by rpcss following remote RPC activity.
- Authentication events on TCP 135 and ephemeral RPC ports originating from low-privileged accounts against domain controllers or member servers.
Detection Strategies
- Monitor Windows Event Log channel Microsoft-Windows-DistributedCOM for activation failures and permission errors, which often precede successful bypass attempts.
- Correlate RPC endpoint mapper connections on TCP 135 with subsequent creation of high-integrity processes on the same host.
- Baseline normal DCOM cross-session activation in your environment and alert on deviations by user, source host, or CLSID.
Monitoring Recommendations
- Enable object access auditing on DCOM launch and access permissions using Component Services (dcomcnfg) and forward events to your SIEM.
- Track Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) for RPC-hosting services and correlate with logon events.
- Alert on non-administrative accounts triggering activation of privileged AppIDs, especially across session boundaries.
How to Mitigate CVE-2024-38061
Immediate Actions Required
- Apply the July 2024 Microsoft security updates to all affected Windows client and server builds as listed in the MSRC advisory.
- Inventory hosts running legacy Windows Server 2008 R2 and 2012 editions and prioritize patching or isolation of those systems.
- Restrict inbound access to TCP 135 and dynamic RPC port ranges to trusted management subnets only.
Patch Information
Microsoft addressed CVE-2024-38061 in the July 9, 2024 Patch Tuesday release. Consult the Microsoft CVE-2024-38061 Advisory for the specific KB article and cumulative update mapped to each Windows version. Verify installation by checking the OS build number against the KB documentation after reboot.
Workarounds
- Where patching is delayed, harden DCOM permissions via dcomcnfg by removing unnecessary Launch, Activation, and Access rights from non-privileged groups.
- Enforce the network-wide DCOM authentication hardening changes introduced with KB5004442, ensuring the RequireIntegrityActivationAuthenticationLevel registry setting is enabled.
- Segment management networks and require jump hosts for administrative RPC/DCOM traffic to reduce exposure to low-privileged attackers.
# Enforce DCOM authentication hardening (see Microsoft KB5004442)
reg add "HKLM\SOFTWARE\Microsoft\Ole\AppCompat" /v "RequireIntegrityActivationAuthenticationLevel" /t REG_DWORD /d 1 /f
# Restart to apply
shutdown /r /t 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
