CVE-2024-43533: Windows 11 21h2 RCE Vulnerability

CVE-2024-43533 Overview

CVE-2024-43533 is a Remote Code Execution vulnerability affecting the Microsoft Remote Desktop Client. This Use After Free (CWE-416) vulnerability allows attackers to execute arbitrary code on vulnerable systems when a user connects to a malicious Remote Desktop server. The attack requires user interaction, specifically tricking a victim into connecting to an attacker-controlled RDP server.

Critical Impact

Successful exploitation allows attackers to achieve complete system compromise through arbitrary code execution with the privileges of the user running the Remote Desktop Client.

Affected Products

• Microsoft Windows 11 21H2 (x64 and ARM64)
• Microsoft Windows 11 22H2 (x64 and ARM64)
• Microsoft Windows 11 23H2 (x64 and ARM64)
• Microsoft Windows 11 24H2 (x64 and ARM64)
• Microsoft Windows Server 2022
• Microsoft Windows Server 2022 23H2 (x64)

Discovery Timeline

• October 8, 2024 - CVE-2024-43533 published to NVD
• October 16, 2024 - Last updated in NVD database

Technical Details for CVE-2024-43533

Vulnerability Analysis

This Remote Code Execution vulnerability stems from a Use After Free (UAF) condition in the Windows Remote Desktop Client. Use After Free vulnerabilities occur when a program continues to use a memory location after it has been freed, potentially allowing attackers to manipulate memory and achieve code execution. In this case, the vulnerability is triggered during RDP client-server communication when processing maliciously crafted responses from a rogue RDP server.

The vulnerability is network-accessible and requires no authentication from the attacker's perspective. However, user interaction is required as the victim must initiate a connection to an attacker-controlled server. This makes social engineering or man-in-the-middle scenarios the primary attack vectors. Successful exploitation results in full compromise of confidentiality, integrity, and availability on the affected system.

Root Cause

The root cause is a Use After Free (CWE-416) memory corruption vulnerability in the Remote Desktop Client. The client improperly handles memory during RDP session processing, allowing an attacker-controlled server to trigger a condition where freed memory is subsequently accessed. This memory corruption can be leveraged to achieve arbitrary code execution within the context of the Remote Desktop Client process.

Attack Vector

The attack requires network access and user interaction to execute:

1. The attacker sets up a malicious RDP server configured to send specially crafted responses
2. The attacker tricks the victim into connecting to the malicious server through phishing, social engineering, or by compromising a legitimate RDP connection (man-in-the-middle)
3. When the victim's Remote Desktop Client connects, the malicious server sends responses that trigger the Use After Free condition
4. The attacker exploits the memory corruption to execute arbitrary code with the privileges of the user running the RDP client

The attack does not require any privileges on the target system prior to exploitation, making it a dangerous initial access vector.

Detection Methods for CVE-2024-43533

Indicators of Compromise

• Unexpected outbound RDP connections to unknown or suspicious IP addresses
• Remote Desktop Client (mstsc.exe) crash events or unexpected termination
• Unusual process spawning from mstsc.exe parent process
• Memory access violation errors in Windows Event Logs related to Remote Desktop Client

Detection Strategies

• Monitor for anomalous RDP connection attempts to non-standard ports or unknown destinations
• Implement network traffic analysis to detect RDP connections to unauthorized external IP addresses
• Deploy endpoint detection rules to monitor mstsc.exe process behavior and child process creation
• Enable Windows Defender Exploit Guard memory protection features to detect exploitation attempts

Monitoring Recommendations

• Review RDP connection logs for connections to unfamiliar or external servers
• Configure SentinelOne to alert on suspicious Remote Desktop Client behavior patterns
• Implement network segmentation to limit RDP traffic to authorized destinations only
• Enable verbose logging for Remote Desktop Client activity in Windows Event Viewer

How to Mitigate CVE-2024-43533

Immediate Actions Required

• Apply the October 2024 Microsoft security updates immediately on all affected Windows 11 and Windows Server 2022 systems
• Restrict users from connecting to untrusted RDP servers through Group Policy
• Educate users about the risks of connecting to unknown or unverified Remote Desktop servers
• Implement network-level controls to restrict outbound RDP connections to approved destinations

Patch Information

Microsoft has released security updates to address this vulnerability as part of the October 2024 Patch Tuesday release. Organizations should apply the appropriate updates for their Windows versions by consulting the Microsoft Security Update Guide for CVE-2024-43533. The patches address the memory handling issue in the Remote Desktop Client that enables the Use After Free condition.

Workarounds

• Restrict outbound RDP connections at the firewall level to only approved, trusted RDP servers
• Disable the Remote Desktop Client feature on systems where it is not required
• Use application whitelisting to control which applications can initiate network connections
• Implement a jump server architecture to centralize and control RDP access

# Group Policy Configuration to restrict RDP client connections
# Navigate to: Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client
# Enable "Allow .rdp files from valid publishers and user's default .rdp settings"
# Enable "Specify SHA1 thumbprints of certificates representing trusted .rdp publishers"

# PowerShell: Check if Remote Desktop Client updates are installed
Get-HotFix | Where-Object { $_.Description -like "*Security Update*" -and $_.InstalledOn -gt "2024-10-01" }

# Restrict outbound RDP at Windows Firewall (example)
New-NetFirewallRule -DisplayName "Block Outbound RDP" -Direction Outbound -Protocol TCP -RemotePort 3389 -Action Block