CVE-2024-42049: TightVNC Information Disclosure Flaw

CVE-2024-42049 Overview

CVE-2024-42049 is a critical information exposure vulnerability affecting TightVNC Server for Windows versions prior to 2.8.84. The vulnerability allows remote attackers to connect to the control pipe via a network connection, potentially leading to unauthorized access and information disclosure. TightVNC is a widely deployed remote desktop software used for remote access and support scenarios across enterprise and personal environments.

Critical Impact

Remote attackers can establish unauthorized network connections to the TightVNC control pipe, potentially gaining access to sensitive system information and control mechanisms without authentication.

Affected Products

• TightVNC Server for Windows versions before 2.8.84

Discovery Timeline

• 2024-07-28 - CVE-2024-42049 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-42049

Vulnerability Analysis

This vulnerability is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The core issue lies in improper access controls on the TightVNC control pipe, which should only be accessible locally but can be reached over the network in vulnerable versions.

TightVNC Server utilizes named pipes for inter-process communication (IPC) between the server component and management utilities. In vulnerable configurations, the control pipe lacks proper network access restrictions, enabling remote attackers to establish connections that should be limited to local system processes.

The network-based attack vector combined with low attack complexity makes this vulnerability particularly dangerous in environments where TightVNC servers are exposed to untrusted networks. Successful exploitation could allow attackers to interact with the control pipe to extract sensitive information or potentially manipulate server behavior.

Root Cause

The vulnerability stems from insufficient access control enforcement on the TightVNC control pipe mechanism. The pipe interface, designed for local administrative communication, fails to properly validate the source of incoming connections, allowing network-based clients to establish sessions that should be restricted to local processes only.

Attack Vector

The attack is conducted over the network and requires no user interaction or prior authentication. An attacker with network access to a vulnerable TightVNC server can directly connect to the exposed control pipe. The exploitation scenario involves:

1. Identifying a TightVNC Server for Windows running a version prior to 2.8.84
2. Establishing a network connection to the control pipe interface
3. Interacting with the pipe to access or manipulate server controls

Technical details regarding the specific pipe names and exploitation techniques can be found in the SourceForge Bug Report #1629.

Detection Methods for CVE-2024-42049

Indicators of Compromise

• Unexpected network connections to TightVNC server processes from external IP addresses
• Anomalous named pipe access patterns in Windows event logs
• Unauthorized connection attempts to TightVNC control interfaces from non-local sources
• Network traffic anomalies involving TightVNC server ports from unexpected sources

Detection Strategies

• Monitor Windows Security Event logs for named pipe access events (Event ID 5145) targeting TightVNC-related pipes
• Implement network traffic analysis to detect unexpected connections to TightVNC server ports
• Deploy endpoint detection rules to identify remote pipe connection attempts to the TightVNC control interface
• Use SentinelOne's behavioral AI to detect anomalous process communications involving TightVNC components

Monitoring Recommendations

• Enable detailed Windows security auditing for object access and named pipe operations
• Configure network segmentation to limit TightVNC server exposure and log boundary traversal attempts
• Implement alerts for any control pipe access originating from non-localhost addresses
• Regularly audit TightVNC server versions across the environment to identify unpatched instances

How to Mitigate CVE-2024-42049

Immediate Actions Required

• Upgrade TightVNC Server for Windows to version 2.8.84 or later immediately
• Restrict network access to TightVNC servers using firewall rules to trusted IP ranges only
• Implement network segmentation to isolate systems running TightVNC from untrusted networks
• Audit all TightVNC installations to identify vulnerable versions in the environment

Patch Information

The vulnerability has been addressed in TightVNC Server for Windows version 2.8.84. Organizations should upgrade to this version or later to remediate the vulnerability. Release notes and download information are available at the TightVNC Release Notes page.

Workarounds

• Deploy host-based firewall rules to block network access to TightVNC control pipe ports from non-local sources
• Use VPN or jump server architectures to limit direct network exposure of TightVNC servers
• Temporarily disable TightVNC services on systems where immediate patching is not possible
• Implement network-level access controls to restrict connections to TightVNC servers to known administrative IP addresses only

# Windows Firewall rule to restrict TightVNC access to specific trusted network
netsh advfirewall firewall add rule name="Block External TightVNC" dir=in action=block protocol=tcp localport=5900-5999 remoteip=any
netsh advfirewall firewall add rule name="Allow TightVNC from Trusted Network" dir=in action=allow protocol=tcp localport=5900-5999 remoteip=192.168.1.0/24