AI
Windows HTTP Services Run Pre-Auth by Default
Almost all Windows HTTP API services accept connections without any authentication. They require no user interaction and no extra configuration. Attackers reach them by default. The researchers used netsh to enumerate every registered HTTP service and its URL, giving them a fast list of targets.
Services built on the HTTP API hand control to the kernel driver HTTP.sys. HTTP.sys handles receiving and sending protocol data through device I/O control codes. Any flaw before the authentication check, if one even exists, is reachable by anyone on the network.
Logic Bugs in the Receive Stage Cause Permanent DoS
Three patterns in the receive loop each produce a permanent freeze. CVE-2024-43512 fixes the receive buffer at 0x1360 bytes. Send a longer header, the function returns error 0xa, and the service loops without updating the buffer size. CVE-2025-27471 hits the UPN service async path: concurrent requests cause early returns with a zero byte count, and the loop never exits even after the attacker disconnects. A third pattern drains the thread pool. IO errors cause each callback thread to exit without spawning a replacement, leaving the service with no receivers.
Unreleased Connections and Reference-Count Mistakes Block Entire Services
When a service receives malformed data and throws an exception, it must call HttpSendHttpResponse or HttpCancelHttpRequest before looping back. Some services skip that step. HTTP.sys never decrements the connection reference count, so the non-paged pool grows until the kernel runs out of memory. The Branch Cache service DoS demo (15:14) shows this triggered from an unauthenticated client.
CVE-2024-38067 hits OCSP under IIS. If a client disconnects before the response flush finishes, PostCompletion is skipped and the IIS API context reference count stays high. At 0x1366 references the service returns 503 to every caller.
Integer Overflow in KDC Proxy Enables Pre-Auth RCE
CVE-2024-43639 is in the KDC Proxy service, which accepts unauthenticated connections over HTTPS. The proxy forwards Kerberos messages received from a socket with no length limit, so an attacker controls a 4-byte length field. In Asn1EncCheck, if the message length exceeds a threshold, the excess is added to a constant of 5. At a message length of 0xFFFFFFFB that addition overflows to zero. The allocator gets a near-zero size and returns a tiny buffer. The write into that buffer overflows controlled memory, crashing with RCX pointing to a non-writable address.
Use-After-Free in RDP Gateway via Connection-ID Race
The RDP Gateway keys connection structures by connection ID in a hash table and stores a buffer pointer inside each. Connect client one with ID “con1,” then disconnect before the send-response callback finishes. The disconnect handler removes the structure from the hash table, but the callback still holds a reference. Before that reference drops, connect client two with the same ID. The receive-data thread from client one’s session pulls client two’s structure and stores the old buffer pointer into it. When the callback finally drops client one’s reference, that pointer is dangling. Client two’s next message writes to freed memory.
Notable Quotes
many default services are built on top Qibo Shi · ▶ 1:20
argument three will be a dangling Victory · ▶ 34:23
Second, doors don’t require crashes, Qibo Shi · ▶ 35:54
Key Takeaways
- Most Windows HTTP API services process attacker-controlled data before any authentication check runs.
- Logical receive-loop bugs, not memory corruption, can permanently freeze a service with a single packet.
- Reference-count misuse in IIS extensions or async callback patterns creates both DoS and RCE primitives.