Loading vulnerability…
CVE-2024-49112 is a critical remote code execution vulnerability in Windows Lightweight Directory Access Protocol (LDAP), with a CVSS base score of 9.8. A remote, unauthenticated attacker can send specially crafted LDAP requests to execute arbitrary code in the context of the LDAP service. Affected products include Windows 10, Windows 11, and multiple Windows Server releases extending back to Windows Server 2008. Microsoft addressed the vulnerability in its December 2024 security updates.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (2 hidden).
This repository provides a proof-of-concept exploit for CVE-2024-49112, a critical vulnerability in the Windows LDAP client that can be triggered remotely to crash Windows Server systems. The exploit is implemented in Python and consists of several components: - `LdapNightmare.py`: The main entry point. It parses command-line arguments, starts a malicious LDAP server (on a configurable UDP port, default 389), and then triggers the target to connect to this server by invoking the Netlogon Remote Protocol (NRPC) DsrGetDcNameEx2 RPC call against the target Windows Server. - `exploit_server.py`: Implements the malicious LDAP server using asyncio and ldaptor. When the victim connects, it sends a specially crafted LDAP referral response (with a referral to 'ldap://referral.com'), which is designed to trigger the vulnerability. - `rpc_call.py`: Handles the NRPC DsrGetDcNameEx2 call using impacket, which is used to force the target to connect to the attacker's LDAP server. - `logger.py`: Provides logging functionality. - `requirements.txt`: Lists dependencies (ldaptor, impacket). - `Readme.md`: Contains detailed setup and usage instructions, including the need for the attacker to control a domain with specific DNS SRV records pointing to the attacker's LDAP server. The exploit requires the attacker to control DNS SRV records for a domain and to run a malicious LDAP server. The attack vector is network-based, targeting Windows Server systems with accessible Netlogon and LDAP services. The exploit's main effect is to crash the target system, demonstrating the vulnerability. No weaponized or post-exploitation payload is included; the exploit is a proof-of-concept for denial of service.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows LDAP vulnerability tested during the operation but found not exploitable in the operators' setup.
Windows LDAP vulnerability attempted during the campaign but reported as not exploitable in the operators' setup.
Unknown (mentioned only as another Windows flaw patched in December 2024).
A critical LDAP remote code execution vulnerability in Windows with CVSS 9.8 affecting supported Windows 10/11 and Windows Server versions back to 2008.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.