CVE-2024-43615: Microsoft OpenSSH for Windows RCE Vulnerability

CVE-2024-43615 Overview

CVE-2024-43615 is a remote code execution vulnerability affecting Microsoft OpenSSH for Windows. The flaw is classified under [CWE-73]: External Control of File Name or Path. Successful exploitation allows an attacker to execute arbitrary code on the target system through the OpenSSH service bundled with Windows.

The vulnerability affects Windows 10, Windows 11, and Windows Server releases where the OpenSSH server component is enabled. Microsoft addressed the issue in the October 2024 Patch Tuesday cycle.

Critical Impact
Exploitation grants remote code execution with high impact on confidentiality, integrity, and availability. The attack requires low privileges, user interaction, and high attack complexity, which typically involves winning a race condition.

Affected Products

Microsoft Windows 10 (versions 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2, 23H2, 24H2)
Microsoft Windows Server 2019, 2022, and 2022 23H2

Discovery Timeline

2024-10-08 - CVE-2024-43615 published to NVD
2024-10-08 - Microsoft releases security update via MSRC
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43615

Vulnerability Analysis

CVE-2024-43615 resides in the Microsoft OpenSSH for Windows implementation. The vulnerability enables remote code execution through improper handling of file paths controlled by external input. An authenticated attacker with low privileges can leverage the flaw to execute code in the context of the SSH service.

The attack requires user interaction and high attack complexity, indicating the presence of a race condition or timing-dependent condition that must be won for exploitation to succeed. When exploited, the vulnerability compromises confidentiality, integrity, and availability of the affected host.

Root Cause

The root cause is mapped to [CWE-73]: External Control of File Name or Path. The OpenSSH for Windows component allows an actor to influence file name or path values used in privileged operations. This influence enables the attacker to redirect file operations to attacker-controlled locations, ultimately leading to code execution.

Attack Vector

Exploitation occurs over the network against systems running OpenSSH Server for Windows. The attacker must hold a valid low-privilege SSH session and induce a specific race condition during file path handling. Because the attack complexity is high and user interaction is required, exploitation is not trivial in default configurations.

No public proof-of-concept exploit code has been released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Microsoft Security Update CVE-2024-43615 advisory for vendor-provided technical detail.

Detection Methods for CVE-2024-43615

Indicators of Compromise

Unexpected sshd.exe child processes spawning shells such as cmd.exe or powershell.exe.
Anomalous file writes by the OpenSSH service to sensitive directories such as %ProgramData%\ssh\ or %SystemRoot%\System32\.
SSH sessions from low-privileged accounts followed by privilege elevation events in the Windows Security log.

Detection Strategies

Monitor Windows Event Log channel OpenSSH/Operational for abnormal session establishment and file path manipulation.
Correlate Sysmon Event ID 1 (process creation) with Event ID 11 (file create) events originating from sshd.exe.
Alert on symbolic link or junction creation events near paths accessed by the OpenSSH service.

Monitoring Recommendations

Enable verbose SSH logging via LogLevel VERBOSE in sshd_config and forward logs to a central SIEM.
Baseline expected SSH client IP ranges and flag connections from unusual sources.
Track authentication events (Event IDs 4624 and 4625) associated with SSH logons for brute-force or unusual access patterns.

How to Mitigate CVE-2024-43615

Immediate Actions Required

Apply the October 2024 Microsoft security updates to all Windows 10, Windows 11, and Windows Server systems.
Inventory hosts with the OpenSSH Server optional feature enabled and prioritize patching for internet-exposed systems.
Restrict SSH access to trusted management networks using firewall rules until patches are deployed.

Patch Information

Microsoft released fixes for CVE-2024-43615 on October 8, 2024. Refer to the Microsoft Security Update CVE-2024-43615 advisory for the specific KB update applicable to each supported Windows build. Install the corresponding cumulative update through Windows Update, WSUS, or your enterprise patching solution.

Workarounds

Disable the OpenSSH Server optional feature on hosts that do not require it: Remove-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0.
Enforce network-level restrictions with Windows Defender Firewall to allow SSH (TCP/22) only from administrative jump hosts.
Require key-based authentication and disable password authentication in sshd_config to reduce the pool of low-privileged accounts that could be leveraged.

bash

# Configuration example: disable OpenSSH server where not required
Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server*'
Remove-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

# Restrict inbound SSH to a management subnet
New-NetFirewallRule -Name 'SSH-Restrict' -DisplayName 'OpenSSH Restricted' `
  -Enabled True -Direction Inbound -Protocol TCP -LocalPort 22 `
  -RemoteAddress 10.10.0.0/24 -Action Allow