CVE-2024-43590: Visual Studio 2017 Elevation Vulnerability

CVE-2024-43590 Overview

CVE-2024-43590 is an Elevation of Privilege vulnerability affecting the Visual C++ Redistributable Installer component bundled with Microsoft Visual Studio. This vulnerability allows a local attacker with low-level privileges to escalate their access to gain full system control. The flaw resides in improper access control mechanisms within the installer process, enabling malicious actors to manipulate the installation workflow to execute arbitrary code with elevated privileges.

Critical Impact

Local attackers can exploit this vulnerability to achieve complete system compromise by escalating from low-privilege user access to full administrative control, potentially leading to unauthorized data access, system modification, and persistent backdoor installation.

Affected Products

• Microsoft Visual Studio 2017
• Microsoft Visual Studio 2019
• Microsoft Visual Studio 2022

Discovery Timeline

• 2024-10-08 - CVE-2024-43590 published to NVD
• 2024-10-16 - Last updated in NVD database

Technical Details for CVE-2024-43590

Vulnerability Analysis

This vulnerability stems from improper access control (CWE-284) within the Visual C++ Redistributable Installer. The installer component, which is responsible for deploying the Visual C++ runtime libraries required by many Windows applications, fails to properly validate and restrict access during its execution. This allows an authenticated local user to manipulate the installation process and gain elevated privileges on the affected system.

The attack requires local access to the target machine, meaning the attacker must already have some level of user access before exploitation. However, no user interaction is required once the attacker has local access, making this a reliable privilege escalation vector. Successful exploitation grants the attacker high-level access to confidentiality, integrity, and availability of the system—effectively providing complete control over the compromised machine.

Root Cause

The root cause of CVE-2024-43590 is an improper access control implementation within the Visual C++ Redistributable Installer. The installer fails to adequately restrict or validate operations during the installation process, allowing an attacker to inject malicious operations or redirect execution flow. This represents a classic case of insufficient privilege separation where a component running with elevated privileges does not properly validate inputs or actions from lower-privileged contexts.

Attack Vector

The attack vector for CVE-2024-43590 is local, requiring the attacker to have existing access to the target system. The exploitation process involves a local user initiating or manipulating the Visual C++ Redistributable Installer to execute malicious code with elevated privileges.

Typical exploitation scenarios may include:

1. An attacker with standard user credentials on a workstation targets the Visual Studio installation process
2. The attacker exploits the improper access control during installer execution
3. Through manipulation of the installation workflow, the attacker gains elevated (SYSTEM-level) privileges
4. With elevated access, the attacker can install persistence mechanisms, access protected data, or move laterally within the network

The vulnerability does not require any user interaction beyond the attacker having local system access, and the attack complexity is considered low.

Detection Methods for CVE-2024-43590

Indicators of Compromise

• Unusual or unexpected Visual C++ Redistributable Installer (vc_redist*.exe) executions, especially from non-standard directories
• Process execution chains showing privilege escalation from standard user context to SYSTEM
• Anomalous child processes spawned by Visual Studio installer components
• Unexpected modifications to Windows registry keys related to Visual Studio or Visual C++ runtime installations

Detection Strategies

• Monitor for execution of vc_redist*.exe and related Visual Studio installer processes, particularly when initiated by non-administrative users
• Implement endpoint detection rules to identify privilege escalation patterns involving Visual Studio components
• Deploy behavior-based detection to identify unusual installer activity that deviates from normal installation workflows
• Correlate Windows Security Event Logs (Event ID 4688 - Process Creation) for installer processes with subsequent high-privilege operations

Monitoring Recommendations

• Enable command-line auditing and process creation logging on systems with Visual Studio installed
• Configure SentinelOne agents to monitor for suspicious installer behavior and privilege escalation attempts
• Implement file integrity monitoring on Visual Studio and Visual C++ Redistributable installation directories
• Review Security Information and Event Management (SIEM) alerts for patterns matching local privilege escalation techniques

How to Mitigate CVE-2024-43590

Immediate Actions Required

• Apply the latest Microsoft security updates for Visual Studio 2017, 2019, and 2022 immediately
• Audit all systems with Visual Studio installed to identify vulnerable versions
• Restrict local access to development workstations and servers where Visual Studio is deployed
• Implement the principle of least privilege to minimize the number of users with local system access

Patch Information

Microsoft has released security updates to address CVE-2024-43590. Organizations should apply the appropriate patches for their Visual Studio versions as detailed in the Microsoft Security Update Guide for CVE-2024-43590. The patches address the improper access control vulnerability in the Visual C++ Redistributable Installer component.

Affected versions and their corresponding updates:

• Visual Studio 2017: Apply the latest servicing release
• Visual Studio 2019: Apply the latest servicing release
• Visual Studio 2022: Apply the latest servicing release

Workarounds

• Limit local user access to systems where Visual Studio is installed until patches can be applied
• Monitor and restrict execution of Visual C++ Redistributable Installer processes through application whitelisting policies
• Isolate development environments from critical production systems to limit the impact of potential exploitation
• Implement network segmentation to contain any compromised development workstations

# Configuration example - Restrict installer execution via AppLocker
# PowerShell command to create an AppLocker rule restricting vc_redist execution
New-AppLockerPolicy -RuleType Path -Path "%PROGRAMFILES%\Microsoft Visual Studio\*\vc_redist*.exe" -Action Deny -User "Everyone"