Windows Zero-Day Vulnerability – CVE-2021-43890

THE THREAT

In Microsoft’s December 14, 2021, Patch Tuesday vulnerability release, security patches were released for a high severity zero-day vulnerability impacting the Windows AppX installer. The vulnerability is tracked as CVE-2021-43890 (CVSS: 7.1). Exploitation allows a threat actor to create a malicious file that appears to be a legitimate application.

Exploitation in the wild has been observed in the delivery of multiple malware types including: Emotet, Trickbot, and BazarLoader. Organizations are strongly recommended to apply the relevant security patches as exploitation is ongoing.

What we’re doing about it

• eSentire MDR for Endpoint and Network have rules in place to detect malware known to be delivered via exploitation of CVE-2021-43890
• eSentire Managed Vulnerability Service (MVS) will automatically add the relevant plugins for this vulnerability once details are made available
• The eSentire Threat Intelligence team is actively tracking this threat for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply the relevant security patches
  • Microsoft Desktop Installer 1.16 for Windows 10, version 1809 and later
  • Microsoft Desktop Installer 1.11 for Windows 10, version 1709 or Windows 10, version 1803
• If patching is not currently possible, alternative mitigations are available in the official vulnerability release
• Ensure your employees and contractors are trained in identifying malicious content delivered via email, and that an established procedure is in place to report potentially malicious content

Additional information

In an attack scenario, threat actors could craft a malicious attachment and deliver it to victims via either email or a link inside of an email; the attachment would appear as a legitimate application. Opening the malicious attachment leads to the deployment of malware. eSentire has detected attacks exploiting this technique. In observed attacks, the malicious attachment mimicked Adobe PDF Reader. An example of Emotet malware being delivered in this fashion is outlined in the December 2021 Threat Intelligence Observations On-Demand webinar.

As exploitation requires user interaction, it is critical that staff are trained in best security practices, especially surrounding email security.

References:

[1] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43890