Critical Active Directory Vulnerability Could Let Attackers Crash Windows Servers

Cybersecurity researchers have warned about a critical vulnerability in Windows Lightweight Directory Access Protocol (LDAP), posing a significant threat to unpatched Windows Servers. This flaw could be exploited to trigger server crashes or enable unauthorized remote access.

What is LDAP?

LDAP (Lightweight Directory Access Protocol) is a popular protocol for accessing and managing directory services over a network. It organizes data hierarchically to make it easier for customers to search and manage information about users, groups, and other entities. LDAP is typically used for authentication and authorization to ensure secure access to resources.

The SafeBreach research team first identified the vulnerability in Active Directory‘s LDAP. The security flaw is tracked as CVE-2024-49113 with a CVSS score of 9.8. Initially thought to cause only Denial of Service (DoS) attacks, further analysis revealed that the flaw could also enable remote code execution

According to the researchers, this vulnerability could be exploited to crash any Windows Server machine. The attack becomes feasible when the target system’s domain controller is connected to an internet-facing DNS server.

“The vulnerability that the SafeBreach Labs PoC exploits affects technology that is in widespread use across enterprise networks, and this flaw could help attackers propagate more easily and effectively,” the SafeBreach research team explained.

How to mitigate the risks of the Active Directory vulnerability?

SafeBreach researchers have noted that there is no evidence of the DoS bug being actively exploited. Fortunately, Microsoft has addressed the flaw in the December 2024 Patch Tuesday updates. Administrators are strongly advised to promptly patch Windows Servers and domain controllers in enterprise environments to mitigate potential risks.

Meanwhile, IT admins who cannot immediately apply security patches to their servers are advised to implement LDAP and RPC firewalls to block attempts to exploit the vulnerability within their organizations. This approach helps to reduce the risk of attacks until the servers can be properly updated.