Critical Microsoft Configuration Manager Vulnerability Exposes Systems to Remote Code Execution

 

Critical Vulnerability in Microsoft Configuration Manager Allows Remote Code Execution

A critical vulnerability, CVE-2024-43468, has been discovered in Microsoft Configuration Manager (ConfigMgr), posing a significant security risk to organizations relying on this popular systems management software.

Overview of CVE-2024-43468

Rated with a CVSS score of 9.8, this vulnerability enables unauthenticated attackers to execute remote code on affected systems, potentially resulting in complete system compromise.

The flaw originates from two unauthenticated SQL injection vulnerabilities in the MP_Location service of ConfigMgr. These vulnerabilities arise due to inadequate input sanitization when processing client messages. Attackers can exploit these weaknesses to execute arbitrary SQL queries on the ConfigMgr database with sysadmin privileges, ultimately enabling remote code execution (RCE) through the xp_cmdshell procedure.

Impacted Versions

The vulnerability affects ConfigMgr versions 2403, 2309, and 2303, especially when the critical patch KB29166583 is not applied. Exploitation requires network access to a Management Point but does not require authentication or user interaction, making it highly exploitable.

Proof-of-Concept Released

Researchers at SynACKTIV have released a proof-of-concept (PoC) script showcasing how attackers can exploit this vulnerability. The PoC outlines two primary attack vectors:

1. MachineID Injection: Attackers inject malicious SQL commands into the SourceID field of an XML message targeting the vulnerable getMachineID function.

2. ContentID Injection: This vector exploits the getContentID function by using a valid MachineID obtained from the system database.

Both methods enable attackers to create new sysadmin accounts or execute commands on the underlying server.

Risks and Consequences

The implications of CVE-2024-43468 are severe:

• Unauthorized Access: Attackers can gain full access to the ConfigMgr database and its contents.

• System Compromise: Escalating privileges allows attackers to execute arbitrary commands, potentially deploying ransomware or other malicious payloads.

• Data Breaches: Sensitive information stored within the ConfigMgr database is at risk.

Mitigation and Recommendations

Microsoft has addressed this vulnerability with patch KB29166583 in the Patch Tuesday update. Organizations using ConfigMgr versions 2303, 2309, or 2403 should immediately apply this update to secure their systems.

Additional mitigation strategies include:

1. Network Segmentation: Limit access to Management Points to trusted networks only.

2. Database Security Best Practices: Validate all SQL inputs and use parameterized queries to prevent injection attacks.

3. Regular Updates: Ensure that all software components are updated promptly when patches are released.

Detecting Exploitation Attempts

Identifying exploitation attempts for CVE-2024-43468 can be challenging, as SQL injection payloads often leave minimal traces in logs. However, anomalies in the MP_Location.log, such as errors following UpdateSFRequestXML messages, may indicate exploitation attempts.