CVE-2024-43545 Overview
CVE-2024-43545 is a denial of service vulnerability affecting the Windows Online Certificate Status Protocol (OCSP) Server component across multiple Microsoft Windows Server releases. A remote, unauthenticated attacker can send specially crafted requests to disrupt the availability of the OCSP service. Microsoft addressed the issue in the October 2024 security update cycle. The vulnerability is categorized under [CWE-400] Uncontrolled Resource Consumption.
Critical Impact
Unauthenticated attackers can remotely exhaust resources on the Windows OCSP Server, disrupting certificate revocation checks across dependent PKI services and potentially affecting downstream authentication and TLS validation operations.
Affected Products
- Microsoft Windows Server 2008 SP2 / 2008 R2 SP1 (x86, x64)
- Microsoft Windows Server 2012 and Windows Server 2012 R2
- Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-10-08 - CVE-2024-43545 published to NVD
- 2024-10-08 - Microsoft releases security patch via Microsoft Security Update
- 2024-10-17 - Last updated in NVD database
Technical Details for CVE-2024-43545
Vulnerability Analysis
The vulnerability resides in the Windows OCSP Server role, a component of Active Directory Certificate Services (AD CS) that responds to certificate revocation status queries. The flaw enables an attacker to trigger uncontrolled resource consumption on the responder. When exploited, the OCSP Server becomes unable to process legitimate certificate status requests.
OCSP responders sit on the critical path for PKI operations. Downstream systems performing TLS handshakes, code signing validation, or smart card authentication may stall or fail when revocation checks cannot complete. Operators relying on OCSP stapling or strict revocation policies will see the largest functional impact.
Root Cause
Microsoft classifies the issue under [CWE-400] Uncontrolled Resource Consumption. The OCSP Server fails to bound the resources consumed when processing certain network-delivered requests. Repeated or malformed requests drive memory, CPU, or handle exhaustion on the responder process.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker reaches the OCSP responder over HTTP, which is the standard OCSP transport defined in RFC 6960. Any internet-exposed or internally reachable OCSP responder is in scope. Microsoft has not published exploitation indicators, and no public proof-of-concept code is available at the time of writing.
For implementation specifics, see the Microsoft Security Update Guide entry for CVE-2024-43545.
Detection Methods for CVE-2024-43545
Indicators of Compromise
- Sudden spikes in HTTP request volume to OCSP responder endpoints, particularly /ocsp paths served by IIS on AD CS hosts.
- Elevated CPU, memory, or handle counts in the ocspsvc.exe process on Windows Server systems hosting the Online Responder role.
- Failed certificate revocation lookups reported by dependent applications, browsers, or VPN gateways.
Detection Strategies
- Baseline normal OCSP request rates per source IP, then alert on statistically significant deviations or repeated identical request patterns.
- Monitor the Windows Event Log channels for the Online Responder Service for service restarts, worker process crashes, or request handling errors.
- Correlate IIS access logs on OCSP responder hosts with process performance counters to identify request floods that precede resource exhaustion.
Monitoring Recommendations
- Place network telemetry sensors in front of OCSP responder endpoints and capture HTTP method, URI, and source distributions.
- Enable performance counter collection for ocspsvc.exe and IIS worker processes feeding the Online Responder application pool.
- Track downstream PKI consumers, including domain controllers, ADFS, and VPN concentrators, for OCSP timeout errors that indicate upstream service degradation.
How to Mitigate CVE-2024-43545
Immediate Actions Required
- Apply the October 2024 Microsoft security updates to all Windows Server systems hosting the OCSP Online Responder role.
- Inventory all internet-facing and internal OCSP responders and prioritize patching of externally reachable hosts first.
- Restrict inbound access to OCSP endpoints to expected client networks where business requirements allow.
Patch Information
Microsoft published cumulative updates addressing CVE-2024-43545 on 2024-10-08. Refer to the Microsoft Security Update Guide for the specific KB article matching each affected Windows Server release, including Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, and 2022 23H2.
Workarounds
- Place a rate-limiting reverse proxy or Web Application Firewall in front of the OCSP responder to cap requests per source IP.
- Deploy redundant OCSP responders behind a load balancer with health checks so a degraded node can be removed from rotation automatically.
- Enable OCSP stapling on TLS servers where supported to reduce direct client load on the responder until patching completes.
# Example IIS request limit configuration for the OCSP responder application pool
appcmd set config /section:requestFiltering /requestLimits.maxAllowedContentLength:16384
appcmd set config /section:requestFiltering /requestLimits.maxUrl:2048
appcmd set config /section:requestFiltering /requestLimits.maxQueryString:1024
# Restart the Online Responder service after applying updates
sc.exe stop OcspSvc
sc.exe start OcspSvc
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
