Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited, publicly disclosed before the fix — Exploitation Less Likely. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
This vulnerability relates to Primary Refresh Tokens which are usually stored in TPM. These tokens are usually used for SSO for Azure AD accounts. The tokens are not encrypted in a strong enough manner, and an administrator with access to a vulnerable system could extract and potentially decrypt the token for reuse until the token expires or is renewed.
Security updates
10.0.17763.2061 — https://support.microsoft.com/help/5004244
10.0.19041.1110 — https://support.microsoft.com/help/5004237
10.0.14393.4530 — https://support.microsoft.com/help/5004238
Vulnerabilities 1
-
High 8.1
Windows AD FS Security Feature Bypass Vulnerability
Windows AD FS Security Feature Bypass Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2021-33779 Windows AD FS Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33779
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss