CVE-2024-43455: Windows Server 2008 Spoofing Vulnerability

CVE-2024-43455 Overview

CVE-2024-43455 is a critical spoofing vulnerability affecting the Windows Remote Desktop Licensing Service across multiple generations of Microsoft Windows Server operating systems. This vulnerability allows unauthenticated attackers to send specially crafted network requests to exploit improper input validation within the Remote Desktop Licensing Service, potentially enabling identity spoofing, data manipulation, and full system compromise.

Critical Impact

This vulnerability enables network-based attacks without authentication, potentially allowing attackers to spoof identities, manipulate licensing data, and compromise Windows Server environments running Remote Desktop Services.

Affected Products

• Microsoft Windows Server 2008 (SP2, R2 SP1) - x64 and x86
• Microsoft Windows Server 2012 and R2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022
• Microsoft Windows Server 2022 23H2

Discovery Timeline

• September 10, 2024 - CVE-2024-43455 published to NVD
• September 13, 2024 - Last updated in NVD database

Technical Details for CVE-2024-43455

Vulnerability Analysis

This spoofing vulnerability resides in the Windows Remote Desktop Licensing Service (RD Licensing), a critical component used to manage client access licenses (CALs) for Remote Desktop Services deployments. The vulnerability stems from improper input validation (CWE-20) within the licensing service's network communication handling.

When the Remote Desktop Licensing Service processes incoming network requests, it fails to properly validate certain input parameters. This improper validation allows an unauthenticated remote attacker to craft malicious requests that can bypass authentication mechanisms and spoof legitimate licensing interactions. The network-accessible nature of this service, combined with the lack of required privileges or user interaction, makes it particularly dangerous in enterprise environments.

The impact of successful exploitation is severe, affecting confidentiality, integrity, and availability of the target system. Attackers could potentially manipulate licensing data, impersonate legitimate license servers, or leverage the vulnerability as part of a larger attack chain to gain unauthorized access to Remote Desktop infrastructure.

Root Cause

The root cause of CVE-2024-43455 is improper input validation (CWE-20) within the Windows Remote Desktop Licensing Service. The service does not adequately sanitize or verify the authenticity of incoming network requests before processing them. This design flaw allows specially crafted packets to be accepted and processed as legitimate, enabling spoofing attacks.

The vulnerability exists because the licensing service trusts certain input parameters without proper verification, allowing an attacker to inject malicious data or impersonate trusted entities within the RD Licensing infrastructure.

Attack Vector

The attack is network-based and can be executed remotely without any authentication or user interaction. An attacker with network access to a vulnerable Windows Server running the Remote Desktop Licensing Service can send specially crafted requests to the service.

The exploitation mechanism involves:

1. Identifying a target Windows Server with the Remote Desktop Licensing Service exposed
2. Crafting malicious network requests that exploit the improper input validation
3. Sending the crafted requests to the licensing service
4. Spoofing legitimate licensing operations or identity to achieve the attacker's objectives

Due to the nature of this vulnerability, no code example is provided. For detailed technical information, refer to the Microsoft Security Advisory.

Detection Methods for CVE-2024-43455

Indicators of Compromise

• Unusual network traffic patterns targeting the Remote Desktop Licensing Service port (TCP 135 for RPC)
• Unexpected license server communications from untrusted IP addresses
• Anomalous licensing-related events in Windows Event Logs
• Suspicious RPC calls to the lserver.exe process

Detection Strategies

• Implement network monitoring for unusual traffic to Remote Desktop Licensing Service endpoints
• Enable detailed logging for the Remote Desktop Licensing Service and monitor for anomalous requests
• Deploy intrusion detection rules to identify malformed RD Licensing protocol traffic
• Utilize SentinelOne behavioral detection to identify exploitation attempts targeting the licensing service

Monitoring Recommendations

• Configure Windows Event Log auditing for Remote Desktop Services-related events
• Monitor lserver.exe process activity for abnormal network connections or behaviors
• Establish baseline network traffic patterns for RD Licensing and alert on deviations
• Implement centralized log aggregation to correlate potential exploitation attempts across the environment

How to Mitigate CVE-2024-43455

Immediate Actions Required

• Apply Microsoft security updates from the September 2024 Patch Tuesday release immediately
• Restrict network access to the Remote Desktop Licensing Service to only authorized systems
• Review firewall rules to limit exposure of RD Licensing Service ports
• Conduct an inventory of all Windows Servers running Remote Desktop Licensing Service

Patch Information

Microsoft has released security patches addressing CVE-2024-43455 as part of their September 2024 security updates. Organizations should apply the appropriate patches for their Windows Server versions immediately. Detailed patch information and download links are available in the Microsoft Security Response Center advisory.

Patches are available for all affected versions including Windows Server 2008 SP2, Windows Server 2008 R2 SP1, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2022 23H2.

Workarounds

• If RD Licensing Service is not required, disable or remove the service from affected servers
• Implement network segmentation to isolate Remote Desktop Licensing servers from untrusted networks
• Configure Windows Firewall to restrict inbound connections to the licensing service from authorized IP addresses only
• Deploy network-level authentication (NLA) enforcement across the RD Services infrastructure

# Disable Remote Desktop Licensing Service if not required
sc config TermServLicensing start= disabled
net stop TermServLicensing

# Restrict RD Licensing Service access via Windows Firewall (example)
netsh advfirewall firewall add rule name="Block RD Licensing External" dir=in action=block service=TermServLicensing remoteip=any
netsh advfirewall firewall add rule name="Allow RD Licensing Trusted" dir=in action=allow service=TermServLicensing remoteip=10.0.0.0/8