CVE-2024-49112 — Windows LDAP Remote Code Execution¶

Key facts

CVE-2024-49112 (Microsoft) is a Critical (9.8) vulnerability: Windows LDAP Remote Code Execution. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab.


CVE	CVE-2024-49112
Severity	Critical (9.8)
Vendor	Microsoft
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2024/CVE-2024-49112/

Details¶

CVE-2024-49112 (Microsoft) is a Critical (9.8) vulnerability: Windows LDAP Remote Code Execution. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Description¶

Critical remote code execution vulnerability in Windows Lightweight Directory Access Protocol (LDAP). An unauthenticated attacker can send specially crafted LDAP calls to execute arbitrary code on target systems.

Affected Versions¶

Windows Server 2008 through 2025
Windows 10/11 all versions
Before December 2024 security update

Mitigation¶

Apply December 2024 Windows security updates
Block LDAP traffic (port 389/636) from untrusted networks
Enable LDAP signing and channel binding
Monitor LDAP traffic for anomalies

Verification Process¶

The PoC uses a multi-stage verification approach:

Step 1: Product/Version Detection (Passive)¶

[*] Query target endpoint
[*] Detect product signatures and extract version
[*] Check if version is in vulnerable range

Step 2: Active Vulnerability Testing¶

Method	Description	Detection
Error-based	Tests for error messages indicating vulnerability	Error indicators in response
Timing-based	Measures response delay with payload	Response time significantly longer
Response-based	Checks for expected patterns in response	Vulnerability indicators present

Verification Flow¶

┌─────────────────────────────────────────────────────────────┐
│                    Product Detection                         │
│  Query target → Detect product/version                      │
│  Check if version in vulnerable range                       │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active Vulnerability Testing                   │
│                                                              │
│  1. Error-based Test                                         │
│     └─ Send payload → Check for error indicators            │
│     └─ If error found → CONFIRMED VULNERABLE                │
│                                                              │
│  2. Timing-based Test                                        │
│     └─ Send delay payload → Measure response time           │
│     └─ If delayed → CONFIRMED VULNERABLE                    │
│                                                              │
│  3. Response-based Test                                      │
│     └─ Send payload → Check response content                │
│     └─ If pattern matches → CONFIRMED VULNERABLE            │
└─────────────────────────────────────────────────────────────┘

Usage¶

# Full vulnerability check (version + active testing)
python3 poc.py -t https://target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://target.com -c --version-only

References¶

Microsoft Security Advisory

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2024-49112, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2024-49112 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2024-49112 - Snort IDS Rules
# Severity: High

# Detect potential exploit attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-49112 Potential Exploit Attempt";
    flow:to_server,established;
    content:".."; http_uri;
    classtype:web-application-attack;
    sid:2024491121;
    rev:1;
    metadata:cve CVE-2024-49112, severity high;
)

# Detect suspicious patterns in request
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2024-49112 Suspicious Request Pattern";
    flow:to_server,established;
    pcre:"/(%2e%2e|%252e|\x00)/Ui";
    classtype:web-application-attack;
    sid:2024491122;
    rev:1;
    metadata:cve CVE-2024-49112, severity high;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2024-49112 - YARA Detection Rules
 */

rule CVE_2024_49112_Exploit {
    meta:
        description = "Detects potential CVE-2024-49112 exploit attempts"
        author = "Security Research Team"
        severity = "high"
        cve = "CVE-2024-49112"

    strings:
        $path_traversal1 = "../" ascii wide
        $path_traversal2 = "..\" ascii wide
        $encoded1 = "%2e%2e" ascii wide nocase
        $encoded2 = "%252e" ascii wide nocase
        $null_byte = "%00" ascii wide

    condition:
        any of them
}

:material-file-download: prevention/yara.yar

# CVE-2024-49112 - Prevention Rules for Nginx

# Block common exploit patterns
location / {
    # Rate limiting
    limit_req zone=general burst=20 nodelay;

    # Block suspicious patterns
    if ($request_uri ~* "(\.\.[\/]|%2e%2e|%252e)") {
        return 403;
    }

    # Security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-XSS-Protection "1; mode=block" always;
}

# Log suspicious activity
access_log /var/log/nginx/CVE-2024-49112-access.log;
error_log /var/log/nginx/CVE-2024-49112-error.log;

:material-file-download: prevention/nginx.conf

# CVE-2024-49112 - Prevention Rules for Apache httpd

# Block common exploit patterns
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block path traversal
    RewriteCond %{REQUEST_URI} (\.\.[\/]|%2e%2e|%252e) [NC]
    RewriteRule .* - [F,L]

    # Block null bytes
    RewriteCond %{REQUEST_URI} %00 [NC]
    RewriteRule .* - [F,L]
</IfModule>

# Security headers
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set X-XSS-Protection "1; mode=block"

# Enable logging
CustomLog /var/log/httpd/CVE-2024-49112-access.log combined
ErrorLog /var/log/httpd/CVE-2024-49112-error.log

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2024-49112?¶