CVE-2024-38258: Windows Server 2008 RD Licensing Flaw

CVE-2024-38258 Overview

CVE-2024-38258 is an information disclosure vulnerability in the Windows Remote Desktop Licensing Service. The flaw affects multiple Microsoft Windows Server releases, from Windows Server 2008 through Windows Server 2022 23H2. An unauthenticated remote attacker can exploit the service over the network to retrieve sensitive information from the host. The vulnerability is associated with [CWE-23] (Relative Path Traversal), suggesting that improper path handling within the licensing service exposes file or memory contents that should remain protected.

Critical Impact
A network-based attacker with no privileges and no user interaction can read sensitive information from a vulnerable Remote Desktop Licensing server, enabling reconnaissance for further attacks against the domain.

Affected Products

Microsoft Windows Server 2008 SP2 and Windows Server 2008 R2 SP1
Microsoft Windows Server 2012 and Windows Server 2012 R2
Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-09-10 - CVE-2024-38258 published to NVD with vendor advisory from Microsoft
2024-09-13 - Last updated in NVD database

Technical Details for CVE-2024-38258

Vulnerability Analysis

The vulnerability resides in the Remote Desktop Licensing Service, a component used to manage Remote Desktop Services client access licenses (RDS CALs). The service is reachable over the network when a server is configured as a license server in an RDS deployment. The CWE classification points to relative path traversal as the underlying weakness, indicating that the service fails to properly canonicalize or validate path components supplied through its protocol. Successful exploitation discloses confidential information from the host without modifying data or interrupting service availability.

Because the licensing service typically runs with high privileges on a Windows Server, the data accessible through the flaw may include file contents, configuration data, or memory regions outside the intended licensing scope. Attackers can use this disclosed material to map internal infrastructure, harvest credentials, or chain into other Remote Desktop Licensing vulnerabilities patched in the same September 2024 update cycle.

Root Cause

The root cause is improper validation of path-like input handled by the licensing service ([CWE-23]). When the service processes a crafted request, traversal sequences are not neutralized, allowing references to resources outside the intended directory or context. This permits the service to return contents the requester should not be able to read.

Attack Vector

The attack vector is network-based with low complexity. The attacker requires no authentication and no user interaction. Exploitation involves sending a crafted request to the Remote Desktop Licensing Service endpoint exposed by an RDS license server. Organizations that expose RDS licensing roles to untrusted networks, including the internet, face the highest exposure.

No public proof-of-concept code or in-the-wild exploitation has been published for this CVE at the time of writing. Refer to the Microsoft Security Update Guide CVE-2024-38258 for vendor technical details.

Detection Methods for CVE-2024-38258

Indicators of Compromise

Unexpected inbound connections to the Remote Desktop Licensing Service port from external or non-administrative hosts.
Anomalous read activity or large outbound responses originating from the lserver.exe process on license server hosts.
Windows event log entries showing repeated RDS licensing protocol requests from a single source in a short window.

Detection Strategies

Inventory all servers with the Remote Desktop Licensing role enabled and confirm whether they are reachable from untrusted networks.
Hunt for crafted RPC or licensing protocol traffic containing path traversal sequences such as ..\ or encoded equivalents.
Correlate licensing service activity with subsequent lateral movement or credential access events on the same host.

Monitoring Recommendations

Enable network telemetry capture on segments containing RDS license servers and forward logs to a centralized analytics platform.
Alert on first-seen client IP addresses connecting to RDS licensing endpoints, particularly from outside management subnets.
Track unexpected child processes or file reads associated with the licensing service for behavioral anomalies.

How to Mitigate CVE-2024-38258

Immediate Actions Required

Apply the Microsoft September 2024 security updates to all Windows Server hosts running the Remote Desktop Licensing role.
Identify any license servers exposed to the internet or untrusted segments and remove that exposure immediately.
Audit accounts and credentials that may have been visible to a license server prior to patching and rotate them if exposure is suspected.

Patch Information

Microsoft released patches for all supported affected versions through the Security Update Guide. Administrators should consult the Microsoft Security Update Guide CVE-2024-38258 advisory for the specific KB articles aligned with each Windows Server build. Out-of-support versions such as Windows Server 2008 and 2012 may require Extended Security Updates (ESU) to receive the fix.

Workarounds

Restrict network access to the Remote Desktop Licensing Service so that only authorized RDS session hosts can reach it, using host firewall rules or network ACLs.
Where the licensing role is no longer required, uninstall the Remote Desktop Licensing role to eliminate the attack surface.
Place RDS infrastructure behind a Remote Desktop Gateway and require VPN or zero-trust access for any external management.

bash

# Example: restrict inbound access to the RDS Licensing Service using Windows Firewall (PowerShell)
New-NetFirewallRule -DisplayName "Restrict RDS Licensing - Allow Mgmt Subnet" `
  -Direction Inbound `
  -Program "%SystemRoot%\System32\lserver.exe" `
  -Action Allow `
  -RemoteAddress 10.0.10.0/24

New-NetFirewallRule -DisplayName "Restrict RDS Licensing - Block All Other" `
  -Direction Inbound `
  -Program "%SystemRoot%\System32\lserver.exe" `
  -Action Block