LDAPNightmare:First Proof-of-Concept Exploit for CVE-2024-49112

Researchers have kicked off 2025 with the release of a zero-click PoC exploit for CVE-2024-49112, dubbed “LDAP Nightmare”. This critical Windows vulnerability has a CVSS score of 9.8, threatening enterprise networks, including Active Directory Domain Controllers.

Key Details:
Type: Remote Code Execution (RCE)
Impact: Crashes unpatched Windows Servers, including Active Directory DCs.
Exploitation Path: Requires no authentication, only Internet connectivity for DNS.
Affected Systems: All unpatched versions of Windows Server (2019–2022).

Exploitation Highlights:
Exploit triggers an LSASS (Local Security Authority Subsystem Service) crash via malicious LDAP queries.
Attack flow involves DNS SRV queries, manipulated NetBIOS/CLDAP responses, and crafted LDAP referral responses.

Mitigation Steps:
Apply the patch immediately: Microsoft’s December 2024 Patch Tuesday addresses this flaw.
Monitor networks: Watch for anomalous LDAP traffic, DNS SRV queries, and CLDAP responses.