Microsoft has disclosed a pre-auth use-after-free vulnerability in the Microsoft Message Queuing (MSMQ) service running on Windows. MSMQ is a message queuing mechanism that allows different systems and processes to communicate reliably.
CVE-2024-30080 is rated critical, with a CVSS score of 9.8, and allows attackers to execute arbitrary code with the privileges of the server process. This issue was reported by k0shl with Kunlun Lab.
What is the impact? #
Successful exploitation of this vulnerability would allow an attacker to execute arbitrary code on the server.
Are updates or workarounds available? #
Microsoft has released an update addressing this vulnerability. Users are encouraged to apply this patch immediately.
How do I find potentially vulnerable systems with runZero? #
From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:
os:Windows AND tcp_port:1801
