QueueJumper
- Product
- Microsoft Windows Message Queuing (MSMQ)
- CVE
- CVE-2023-21554
- Disclosed
- 2023-04-11
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- no
- Affected
- Windows 10, 11, Server 2008 through 2022 with the Message Queuing service enabled (often silently enabled by Exchange and other products).
- Fixed
- April 2023 Patch Tuesday updates.
Summary
A critical bug in the MSMQ service found by Check Point. Sending a crafted packet to TCP port 1801 gives unauthenticated code execution, and Check Point found more than 360,000 hosts exposing that port.
Root cause
mqqm.dll fails to validate field lengths and offsets inside the MSMQ message header sections while parsing an incoming message, leading to an out-of-bounds write in the service's memory, which can be developed into code execution as the MSMQ service account.
Impact
Unauthenticated remote code execution on any Windows host with MSMQ listening on TCP/1801.
Detection
Find exposure with: Get-WindowsFeature MSMQ / Get-Service MSMQ, or scan for TCP/1801 (nmap -p1801). Check for April 2023 updates.
Mitigation
Patch; disable the Message Queuing feature where not needed and block inbound TCP/1801 from untrusted sources.