CVE-2024-43454: Windows Server 2008 RCE Vulnerability

CVE-2024-43454 Overview

CVE-2024-43454 is a remote code execution vulnerability in the Windows Remote Desktop Licensing Service. The flaw affects multiple Microsoft Windows Server releases running the Remote Desktop Licensing role. Microsoft classifies the issue under [CWE-23] Relative Path Traversal, indicating that untrusted input reaches file path handling logic in the licensing service. An authenticated attacker with low privileges can send crafted network traffic to a vulnerable host and trigger the flaw. Successful exploitation impacts integrity and availability of the target system without requiring user interaction.

Critical Impact

An authenticated network attacker can exploit path traversal in the Remote Desktop Licensing Service to execute code and disrupt licensing operations on Windows Server hosts.

Affected Products

• Microsoft Windows Server 2008 SP2 and R2 SP1 (x86 and x64)
• Microsoft Windows Server 2012 and 2012 R2
• Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• 2024-09-10 - CVE-2024-43454 published to NVD
• 2026-08-10 - Last updated in NVD database

Technical Details for CVE-2024-43454

Vulnerability Analysis

The vulnerability resides in the Remote Desktop Licensing Service, a component that manages Remote Desktop Services client access licenses on Windows Server. The service processes license requests over the network and interacts with the file system when storing or retrieving license data. Improper validation of path components allows an attacker to influence file operations outside the expected directory. Microsoft classifies the weakness as relative path traversal under [CWE-23]. Exploitation requires the attacker to hold low-privilege credentials on the network path reachable by the licensing service. The EPSS model places this CVE in a high-probability band relative to the broader CVE population, indicating meaningful attacker interest in similar RDS licensing flaws.

Root Cause

The root cause is insufficient sanitization of relative path segments processed by the licensing service. When user-influenced input is concatenated into a file path without canonicalization, sequences such as ..\ can escape the intended directory. The service then reads from or writes to attacker-controlled locations, which enables code execution paths depending on where the traversal lands.

Attack Vector

Exploitation occurs over the network against a Windows Server running the Remote Desktop Licensing role. The attacker must first authenticate with low privileges to reach the licensing RPC or protocol surface. No user interaction on the target is required. A successful request abuses path traversal in file handling to compromise integrity and, in some cases, availability of the licensing service and host.

See the Microsoft Security Update Guide entry for CVE-2024-43454 for the technical write-up and update packages.

Detection Methods for CVE-2024-43454

Indicators of Compromise

• Unexpected files or directories created under the Remote Desktop Licensing service working paths, particularly files containing ..\ sequences in request logs.
• Crashes, restarts, or abnormal termination of the TermServLicensing service on domain-joined or standalone license servers.
• Anomalous authenticated RPC connections to TCP port 135 and ephemeral RPC endpoints on hosts running the RD Licensing role.

Detection Strategies

• Monitor Windows Event Log for Service Control Manager events tied to the Remote Desktop Licensing service and correlate with inbound network sessions.
• Alert on file writes by lserver.exe or related licensing binaries to paths outside the standard %SystemRoot%\System32\LServer directory.
• Baseline license request volumes per source and flag deviations, particularly requests originating from non-administrative accounts or unmanaged hosts.

Monitoring Recommendations

• Enable process creation auditing (Event ID 4688) and command-line logging on all Windows Server hosts running the RD Licensing role.
• Forward RDS, RPC, and licensing service telemetry to a centralized SIEM or data lake for retention and cross-host correlation.
• Track patch state for the Remote Desktop Licensing role across the estate and alert on hosts missing the September 2024 security update.

How to Mitigate CVE-2024-43454

Immediate Actions Required

• Apply the September 2024 Microsoft security update that addresses CVE-2024-43454 on every Windows Server hosting the Remote Desktop Licensing role.
• Inventory all servers with the RD Licensing role installed and prioritize internet-adjacent or multi-tenant hosts for immediate patching.
• Restrict inbound access to the licensing service to trusted RDS session hosts using host-based firewall rules and network segmentation.

Patch Information

Microsoft has released security updates for all affected Windows Server versions. Refer to the Microsoft Security Update Guide for CVE-2024-43454 to obtain the correct KB article and update package for each operating system build.

Workarounds

• If patching cannot be performed immediately, remove or disable the Remote Desktop Licensing role on hosts that do not require it.
• Limit RPC and licensing protocol reachability to a defined allowlist of RDS session host IP addresses via Windows Defender Firewall.
• Enforce strong authentication and remove low-privilege accounts that do not require access to license servers, reducing the pool of viable attacker identities.

# Configuration example: restrict inbound RPC access to trusted RDS hosts
New-NetFirewallRule -DisplayName "Restrict RD Licensing RPC" `
  -Direction Inbound `
  -Protocol TCP `
  -LocalPort 135 `
  -RemoteAddress 10.0.10.0/24 `
  -Action Allow