About Remote Code Execution – Microsoft Configuration Manager (CVE-2024-43468) vulnerability. This vulnerability is from the October 2024 MSPT. Microsoft Configuration Manager (ConfigMgr) is used to manage large groups of computers, providing remote control, patch management, software distribution, operating system deployment, etc.
According to Microsoft, the vulnerability allowed an unauthenticated attacker to execute commands at the server or database level by sending specially crafted requests to the Management Point.
Synacktiv experts revealed the details 100 days after the October MSPT, on January 16. MP_Location service processed client messages insecurely. This flaw enabled attackers to perform SQL injections and execute arbitrary database queries with the highest privileges, including running commands on the server via xp_cmdshell. 🤷♂️
Public exploits are available on GitHub. There are no reports of exploitation in the wild yet.
Hi! My name is Alexander and I am a Vulnerability Management specialist. You can read more about me here. Currently, the best way to follow me is my Telegram channel @avleonovcom. I update it more often than this site. If you haven’t used Telegram yet, give it a try. It’s great. You can discuss my posts or ask questions at @avleonovchat.
А всех русскоязычных я приглашаю в ещё один телеграмм канал @avleonovrus, первым делом теперь пишу туда.