CVE-2024-43607: Windows Server 2008 RRAS RCE Vulnerability

CVE-2024-43607 Overview

CVE-2024-43607 is a remote code execution vulnerability in the Windows Routing and Remote Access Service (RRAS). The flaw stems from a heap-based buffer overflow [CWE-122] in the RRAS component, which provides routing services and remote access connectivity in Windows Server. An unauthenticated attacker can trigger code execution by convincing a target to interact with a malicious request, as indicated by the User Interaction Required attribute. Microsoft addressed the vulnerability in its October 2024 Patch Tuesday release. Affected systems span the full range of supported Windows Server versions, from Windows Server 2008 through Windows Server 2022 23H2.

Critical Impact
Successful exploitation grants attackers the ability to execute arbitrary code on affected Windows Servers running RRAS, leading to full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft Windows Server 2008 SP2 and Windows Server 2008 R2 SP1
Microsoft Windows Server 2012 and Windows Server 2012 R2
Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-10-08 - CVE-2024-43607 published to NVD and Microsoft releases security patch
2024-10-22 - Last updated in NVD database

Technical Details for CVE-2024-43607

Vulnerability Analysis

The Routing and Remote Access Service is an optional Windows Server role that provides routing, VPN, and dial-up remote access functionality. CVE-2024-43607 is a heap-based buffer overflow [CWE-122] within RRAS request processing. The vulnerability allows network-based remote code execution against servers with the RRAS role enabled. Exploitation requires user interaction, which Microsoft typically defines as convincing an authorized user to connect to an attacker-controlled server or initiate a network request that the attacker can intercept. Successful exploitation results in code execution in the context of the RRAS service, which runs with elevated privileges on the host.

Root Cause

The root cause is improper validation of attacker-controlled data sizes when RRAS allocates and copies data into heap buffers. When the service processes a crafted request, the overflow corrupts adjacent heap structures and can be leveraged to redirect execution flow. The vulnerability is categorized under CWE-122 (Heap-based Buffer Overflow).

Attack Vector

The attack vector is network-based with low complexity and no privileges required, but user interaction is required to trigger the vulnerable code path. An attacker typically lures a victim with RRAS connectivity to communicate with a malicious endpoint, where the server response triggers the overflow. Because RRAS is commonly deployed on perimeter VPN and routing servers, exploitation can provide attackers a foothold in network-edge infrastructure. Microsoft has not released technical specifics, and no public proof-of-concept is available at this time. Refer to the Microsoft Security Update CVE-2024-43607 for vendor details.

Detection Methods for CVE-2024-43607

Indicators of Compromise

Unexpected crashes or restarts of the RemoteAccess service or the svchost.exe process hosting RRAS
Anomalous outbound connections from RRAS servers to untrusted external endpoints
Creation of new processes by the RRAS service or unusual child processes spawned under svchost.exe
Unexpected modifications to RRAS configuration keys under HKLM\SYSTEM\CurrentControlSet\Services\RemoteAccess

Detection Strategies

Monitor for Windows Error Reporting and crash dump events tied to the RemoteAccess service after suspicious inbound or outbound RRAS traffic
Alert on RRAS hosts initiating outbound connections to internet endpoints that fall outside expected VPN or routing peers
Correlate process creation events where the RRAS-hosting svchost.exe spawns shells, scripting hosts, or LOLBins such as cmd.exe, powershell.exe, or rundll32.exe

Monitoring Recommendations

Ingest Windows Security, System, and Sysmon logs from all RRAS-enabled servers into a centralized SIEM for correlation
Track inbound traffic to RRAS listener ports (typically UDP 500/4500 for IKE, TCP 1723 for PPTP, TCP 443 for SSTP) for anomalous volume or malformed packets
Establish a baseline of legitimate RRAS client endpoints and alert on deviations

How to Mitigate CVE-2024-43607

Immediate Actions Required

Apply the October 2024 Microsoft security updates to all Windows Server systems running RRAS as the primary remediation
Inventory all servers with the Remote Access role enabled and prioritize internet-facing systems for patching
Disable RRAS on systems where the role is not required to eliminate the attack surface

Patch Information

Microsoft published the patch on October 8, 2024 via the standard Patch Tuesday channel. Updates are available for Windows Server 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, 2019, 2022, and 2022 23H2. Consult the Microsoft Security Update CVE-2024-43607 page for KB numbers corresponding to each supported version.

Workarounds

If patching cannot be completed immediately, disable the RemoteAccess service on hosts where RRAS is not actively in use
Restrict inbound access to RRAS listener ports using host-based and perimeter firewalls, allowing only known VPN client subnets
Place RRAS servers behind network segmentation so that compromised systems cannot pivot freely to internal assets

bash

# Configuration example: disable RRAS where it is not required
sc.exe config RemoteAccess start= disabled
sc.exe stop RemoteAccess

# Verify the role status via PowerShell
Get-WindowsFeature -Name RemoteAccess
Uninstall-WindowsFeature -Name RemoteAccess -Remove