Security Digest (June 2024)

Microsoft assesses threats based on the theoretical worst possible outcome were a vulnerability to be exploited. The assessment factors in how easily a vulnerability can be exploited, and what damage could be done.

Of these 51 vulnerabilities, 1 is considered Critical. Details on this vulnerability can be seen below:

• CVE-2024-30080: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

Microsoft Message Queuing, or MSMQ, is a messaging protocol that allows applications running on separate servers/processes to communicate in a failsafe manner. A queue is a temporary storage location from which messages can be sent and received reliably, as and when conditions permit. This enables communication across networks and between computers, running Windows, which may not always be connected. Delivery will occur when the process on the other end ‘wakes up’ and receives notification of the message’s arrival. As this is a communication service, Windows PCs and servers are often in a state of waiting for MSMQ messages (or, ‘Listening’), leaving them particularly vulnerable to attackers.

CVE-2024-30080 involves targeting a vulnerable device with a series of specially crafted MSMQ packets in a rapid sequence over HTTP to a MSMQ server. This could result in remote code execution on the server side.

It is of note that this vulnerability is regarded as a 9.8/10. Let’s look at the Common Vulnerabilities Scoring System to determine how this number is generated. Below, you’ll see the official designation of this vulnerability from the National Institute of Standards and Technology (or NIST).

Using the above scoring system, we can start to translate the string of values and calculate our total risk score. Note the string below:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

While this may appear to be nonsense, each letter denotes a specific value and provides information on the vulnerability. The acronyms are as follows:

• CVSS 3.1 designates the scoring system in use
• AV (Attack Vector): Describes how an attacker can exploit the vulnerability (e.g., local, adjacent network, or network)
• AC (Attack Complexity): Reflects how difficult it is to exploit the vulnerability (e.g., low, medium, or high)
• PR (Privileges Required): Indicates the level of privileges an attacker needs to exploit the vulnerability (e.g., none, low, or high)
• UI (User Interaction): Specifies whether user interaction is required to exploit the vulnerability (e.g., none, required)
• S (Scope): Determines whether exploitation of the vulnerability impacts components beyond the vulnerable component

The final three letters make up what is known as the ‘Security Triad’ or ‘CIA’ (Confidentiality, Integrity, Availability).

• C (Confidentiality): A measure of how this vulnerability potentially impacts the privacy of end user data (Asks ‘Can a threat actor access data for which they are not authorized?’)
• I (Integrity): A measure of how this vulnerability potentially impacts the reliability of data in the victim’s environment (Asks ‘Can a threat actor change or tamper any data?)
• A (Availability): A measure of how this vulnerability potentially impacts the ability to access data and services (Asks ‘Can a threat actor destroy data or take down services?)

These are known as the Base Metrics. The base metrics are then scored based on the vulnerability, as seen below:

Attack Vector (AV): This metric reflects how the vulnerability is exploited

• N (Network): The vulnerability is exploitable from remote locations
• A (Adjacent Network): The vulnerability is exploitable from an adjacent network
• L (Local): The vulnerability is exploitable locally
• P (Physical): The vulnerability requires physical access to exploit

Attack Complexity (AC): This metric describes the conditions that must be met by the attacker to exploit the vulnerability

• L (Low): The attack is straightforward without special conditions
• H (High): The attack requires specific conditions that are beyond the attacker’s control

Privileges Required (PR): This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability.

• N (None): No privileges are required
• L (Low): The attacker needs basic user privileges
• H (High): The attacker needs high privileges, such as administrative or root access

User Interaction (UI): This metric captures whether the vulnerability requires user interaction to be exploited.

• N (None): No user interaction is required
• R (Required): Exploitation requires user interaction

Scope (S): This metric describes whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope.

• U (Unchanged): The impact is limited to the vulnerable component
• C (Changed): The impact can extend beyond the vulnerable component

Confidentiality (C): This metric measures the impact on the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability.

• • H (High): A total loss of confidentiality
  • L (Low): Some loss of confidentiality
  • N (None): No impact on confidentiality

Integrity (I): This metric measures the impact on the integrity of a successfully exploited vulnerability.

• H (High): A total loss of integrity
• L (Low): Some loss of integrity
• N (None): No impact on integrity

Availability (A): This metric measures the impact on the availability of the impacted component resulting from a successfully exploited vulnerability.

• H (High): A total loss of availability
• L (Low): Some loss of availability
• N (None): No impact on availability

By analyzing our original CVSS string, we can get a clear picture of exactly what makes this vulnerability so dangerous:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AV (Attack Vector): N (Network)

• AV: Indicates how the vulnerability is exploited
• N (Network): The vulnerability can be exploited remotely over a network (from any location)

AC (Attack Complexity): L (Low)

• AC: Describes the conditions beyond the attacker’s control that must exist to exploit the vulnerability
• L (Low): The attack does not require any special conditions, meaning it is straightforward to execute

PR (Privileges Required): N (None)

• PR: Describes the level of privileges an attacker must possess before successfully exploiting the vulnerability
• N (None): The attacker does not require any privileges to exploit the vulnerability

UI (User Interaction): N (None)

• UI: Captures whether the vulnerability requires user interaction to be exploited
• N (None): The vulnerability can be exploited without any user interaction

S (Scope): U (Unchanged)

• S: Indicates whether a successful exploit of the vulnerability can affect resources beyond the security scope of the vulnerable component
• U (Unchanged): A successful attack only impacts resources that are within the same security scope

C (Confidentiality): H (High)

• C: Measures the impact on the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability
• H (High): There is a total loss of confidentiality, resulting in all resources within the impacted component being compromised

I (Integrity): H (High)

• I: Measures the impact on the integrity of a successfully exploited vulnerability
• H (High): There is a total loss of integrity, or a complete compromise of the system integrity

A (Availability): H (High)

• • A: Measures the impact on the availability of the impacted component resulting from a successfully exploited vulnerability
  • H (High): There is a total loss of availability, rendering the component completely unavailable