Of the vulnerabilities found, one in particular was especially severe. The flaw (CVE-2023-21554) Dubbed QueueJumper by CPR, allows unauthorized attackers to remotely execute arbitrary code in the context of the Windows service process. 

The other vulnerabilities were CVE-2023-21769, a remote application denial of service (DoS), and CVE-2023-28302, a remote kernel level DoS. All three vulnerabilities were discovered and patched in Microsoft’s update on Tuesday. 

QueueJumper allows attackers to access remote code execution on unpatched Windows servers with MSMQ packets in low-complexity attacks that don’t require user-interaction. CPR found that approximately 360,000 IPs running the MSMQ service are vulnerable to the attack. The total number may be higher than that, on account of devices running the service that are not reachable over the internet. 

The service itself (MSMQ) is a technology that enables asynchronous communication between applications. It is a common choice for applications that can support heterogeneous networks and offline usage. Even though the service is optional on Windows, not enabled by default, it will commonly be toggled on the background without the user’s knowledge to install software and remain running after installation. 

Recommended

• Not Just a Woman in Tech | CGI’s Aimee Jarvie
• How the Tech Industry Can Tackle the E-waste Crisis Head on
• Forrit to Expand After £5M from Scottish National Investment Bank

The researchers at CPR highly recommend administrators to check servers and clients to see if the MSMQ service is installed. To do this, check if a service called Message Queuing is running, and if TCP port 1801 is listening. If so, double-check if it is needed. In general, closing unnecessary attack surfaces is a best practice in security. 

CPR released their findings to raise awareness of the vulnerability along with defense insights and mitigation recommendations for Windows users. It will release the full technical details of the vulnerability later this month, in hopes of giving users enough time to patch their machines before publicly disclosing the technical details.