CVE-2023-36871: Azure Active Directory Security Feature Bypass Vulnerability

Overview

Severity
Medium (CVSS 6.5)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:F/RL:O/RC:C
Category
Security Feature Bypass
Exploit Status
Not Exploited
Exploitation Likelihood
More Likely
Patch Tuesday
2023-Jul
Released
2023-07-11
EPSS Score
0.27% (percentile: 51.0%)

FAQ

What kind of security feature could be bypassed by successfully exploiting this vulnerability? An attacker can bypass Windows Trusted Platform Module by crafting an assertion and using the assertion to request a Primary Refresh Token from another device. According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability? An attacker would require access to a low privileged session on the user's device to obtain a JWT (JSON Web Token) which can then be used to craft a long-lived assertion using the Windows Hello for Business Key from the victim's device. According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of integrity (I:H)? What does that mean for this vulnerability? By exploiting this vulnerability, an attacker can craft a long-lived assertion and impersonate a victim user affecting the integrity of the assertion. What actions do I need to take to be protected from this vulnerability? Customers should install Windows updates released on or after July 11, 2023 on client devices with Windows OS. Please refer the affected software section to apply the update. What actions do I need to take to be protected from this vulnerability? To be protected, apply the fix as follows: Install Windows updates released on or after July 11, 2023 on all AD FS servers of the farm. Then, enable the setting by running the following PowerShell command on the primary AD FS server of the farm: Set-AdfsProperties-EnforceNonceInJWT Enabled Important You may see authentication failures in certain scenarios when there are clients that are not updated and send JWT authentication requests to the AD FS server. In such cases, we recommend updating all clients by installing the Windows update released on or after July 11, 2023. Alternatively, an administrator can disable the EnforceNonceInJWT setting and monitor the AD FS servers for the logging of Event 187 to identify potential requests that could be reject

Affected Products (23)

Windows

  • Windows 10 Version 1809 for 32-bit Systems
  • Windows 10 Version 1809 for x64-based Systems
  • Windows 10 Version 1809 for ARM64-based Systems
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2022 (Server Core installation)
  • Windows 11 version 21H2 for x64-based Systems
  • Windows 11 version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for 32-bit Systems
  • Windows 10 Version 21H2 for ARM64-based Systems
  • Windows 10 Version 21H2 for x64-based Systems
  • Windows 11 Version 22H2 for ARM64-based Systems
  • Windows 11 Version 22H2 for x64-based Systems
  • Windows 10 Version 22H2 for x64-based Systems
  • Windows 10 Version 22H2 for ARM64-based Systems
  • Windows 10 Version 22H2 for 32-bit Systems
  • Windows 10 for 32-bit Systems
  • Windows 10 for x64-based Systems
  • Windows 10 Version 1607 for 32-bit Systems
  • Windows 10 Version 1607 for x64-based Systems
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)

Security Updates (7)

Acknowledgments

<a href="https://twitter.com/_dirkjan">Dirk-jan Mollema</a> with <a href="https://outsidersecurity.nl/">Outsider Security</a>

Revision History

  • 2023-07-11: Information published.