CVE-2024-49113 — Windows LDAP DoS Vulnerability PoC

Author: SafeBreach Status: Patched (Microsoft, December 2024 Patch Tuesday)
CVSSv3 Score: 7.5 (High)

Bypass Windows Server and commercial EDR

Author: Tim Shing Status: Unpatched CVSSv3 Score: 7.4 (High)

⚠️ Disclaimer

This repository is for educational and authorised security research purposes only.
Do not use this against any system without explicit written permission from the system owner.
The author accepts no responsibility for misuse of this code.

Vulnerability Overview

Root Cause

Unpatched Windows systems expose LDAP on port 389 without encryption, allowing a remote attacker to trigger a crash via a malformed LDAP request, resulting in system shutdown or restart (DoS). Bypass Windows EDR techical skill non-disclose #ethical responsibility

Discovery & Research Process

This vulnerability was investigated as part of my Final Year Project on automated vulnerability scanning and exploit development.

Methodology:

1. Automated network scanning with Nmap to identify hosts with port 389 open
2. Vulnerability validation using Nessus (plugin for LDAP exposure)
3. Reproduction of DoS condition in an isolated lab environment (Windows Server 2022 VM)
4. Documentation of attack vector, impact, and remediation

Repository Contents

├── exploit/
│   └── LdapNightmare.py   # PoC — lab use only
|   └── logger.py
|   └── rpc_call.py

Remediation (Defence Perspective)

This is the most important part — knowing how to fix it:

1. Apply Microsoft patch KB5048239 immediately (December 2024 Patch Tuesday)
2. Block port 389 (unencrypted LDAP) at firewall level; enforce LDAPS (port 636) only
3. Disable legacy LDAP via Group Policy: Network security: LDAP client signing requirements → Require signing
4. Monitor for anomalous LDAP traffic using SIEM rules targeting high-volume port 389 connections
5. Risk treatment (ISO 27001 Annex A):
   • A.8.8 — Management of technical vulnerabilities
   • A.8.20 — Networks security controls

Lab Environment

All testing was conducted in an isolated, offline virtual lab:

• VMware Workstation (host-only network)
• Windows Server 2019 (unpatched, intentionally vulnerable target)
• Kali Linux (attacker machine)

No production or third-party systems were involved.

References

• Microsoft Security Advisory — CVE-2024-49113
• NVD Entry
• NIST SP 800-115 — Technical Guide to Information Security Testing
• ISO/IEC 27001:2022 Annex A Controls

Contact

Tim Shing
📧 [email protected]
🔗 LinkedIn
📍 Hong Kong