CVE-2024-49113 — Updated!
FYP: Reproduced CVE-2024-49113 PoC on Windows Server 2019 (ref. SafeBreach); assessed Windows EDR detection gaps and produced ISO 27001-aligned remediation report.
CVE-2024-49113 — Windows LDAP DoS Vulnerability PoC
Author: SafeBreach Status: Patched (Microsoft, December 2024 Patch Tuesday)
CVSSv3 Score: 7.5 (High)
Bypass Windows Server and commercial EDR
Author: Tim Shing Status: Unpatched CVSSv3 Score: 7.4 (High)
⚠️ Disclaimer
This repository is for educational and authorised security research purposes only.
Do not use this against any system without explicit written permission from the system owner.
The author accepts no responsibility for misuse of this code.
Vulnerability Overview
| Field | Detail |
|---|---|
| CVE ID | CVE-2024-49113 |
| Affected Component | Windows Lightweight Directory Access Protocol (LDAP) |
| Vulnerability Type | Denial of Service (DoS) |
| Attack Vector | Network (unauthenticated) |
| Affected Systems | Windows Server 2019, 2022; Windows 10/11 (unpatched) |
| Patch Available | Yes — KB5048239 (December 2024) |
Root Cause
Unpatched Windows systems expose LDAP on port 389 without encryption, allowing a remote attacker to trigger a crash via a malformed LDAP request, resulting in system shutdown or restart (DoS). Bypass Windows EDR techical skill non-disclose #ethical responsibility
Discovery & Research Process
This vulnerability was investigated as part of my Final Year Project on automated vulnerability scanning and exploit development.
Methodology:
- Automated network scanning with Nmap to identify hosts with port 389 open
- Vulnerability validation using Nessus (plugin for LDAP exposure)
- Reproduction of DoS condition in an isolated lab environment (Windows Server 2022 VM)
- Documentation of attack vector, impact, and remediation
Repository Contents
├── exploit/
│ └── LdapNightmare.py # PoC — lab use only
| └── logger.py
| └── rpc_call.py
Remediation (Defence Perspective)
This is the most important part — knowing how to fix it:
- Apply Microsoft patch KB5048239 immediately (December 2024 Patch Tuesday)
- Block port 389 (unencrypted LDAP) at firewall level; enforce LDAPS (port 636) only
- Disable legacy LDAP via Group Policy:
Network security: LDAP client signing requirements → Require signing - Monitor for anomalous LDAP traffic using SIEM rules targeting high-volume port 389 connections
- Risk treatment (ISO 27001 Annex A):
- A.8.8 — Management of technical vulnerabilities
- A.8.20 — Networks security controls
Lab Environment
All testing was conducted in an isolated, offline virtual lab:
- VMware Workstation (host-only network)
- Windows Server 2019 (unpatched, intentionally vulnerable target)
- Kali Linux (attacker machine)
No production or third-party systems were involved.
References
- Microsoft Security Advisory — CVE-2024-49113
- NVD Entry
- NIST SP 800-115 — Technical Guide to Information Security Testing
- ISO/IEC 27001:2022 Annex A Controls
Contact
Tim Shing
📧 [email protected]
🔗 LinkedIn
📍 Hong Kong