CVE-2021-31962: Windows 10 Kerberos Auth Bypass Flaw

CVE-2021-31962 Overview

CVE-2021-31962 is a critical security feature bypass vulnerability affecting the Kerberos authentication protocol implementation in Microsoft Windows AppContainer environments. This vulnerability allows remote attackers to bypass security restrictions designed to isolate applications running within AppContainers, potentially enabling unauthorized access to enterprise authentication capabilities that should be restricted.

The AppContainer security boundary is a fundamental Windows security feature designed to limit the capabilities of Universal Windows Platform (UWP) applications and sandboxed processes. When this boundary is compromised, applications that should be restricted from accessing network authentication services can leverage Kerberos to authenticate to enterprise resources.

Critical Impact

Remote attackers can bypass AppContainer security restrictions to gain unauthorized enterprise authentication capabilities, potentially compromising domain credentials and enabling lateral movement within enterprise networks without user interaction.

Affected Products

• Microsoft Windows 10 (multiple versions including 1607, 1809, 1909, 2004, 20H2, 21H1)
• Microsoft Windows 7 SP1
• Microsoft Windows 8.1
• Microsoft Windows RT 8.1
• Microsoft Windows Server 2008 SP2 and R2 SP1
• Microsoft Windows Server 2012 and R2
• Microsoft Windows Server 2016 (including 2004, 20H2)
• Microsoft Windows Server 2019

Discovery Timeline

• 2021-06-08 - CVE CVE-2021-31962 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-31962

Vulnerability Analysis

This vulnerability exists within the Windows Kerberos implementation's handling of AppContainer capabilities. AppContainers are designed to provide a restrictive sandbox environment where applications have limited access to system resources and network capabilities. The Enterprise Authentication capability is specifically restricted to prevent sandboxed applications from automatically authenticating to enterprise resources using domain credentials.

The flaw allows an attacker to bypass this restriction, enabling a malicious application running within an AppContainer to leverage Kerberos authentication mechanisms that should be inaccessible. This effectively breaks the security isolation model that organizations rely on to contain potentially untrusted applications.

The attack can be executed remotely over the network without requiring any privileges or user interaction, making it particularly dangerous in enterprise environments where automatic Kerberos authentication is prevalent.

Root Cause

The root cause stems from improper enforcement of AppContainer capability restrictions within the Windows Kerberos authentication subsystem. When an AppContainer application attempts to use Kerberos authentication, the security checks fail to properly validate the application's capability manifest, allowing it to bypass the Enterprise Authentication capability requirement.

This represents a fundamental flaw in the security boundary enforcement between the AppContainer isolation layer and the Kerberos Service Security Provider (SSP). The Kerberos SSP does not correctly query or validate the AppContainer token's capability SIDs before granting authentication access.

Attack Vector

The attack leverages the network-accessible nature of Kerberos authentication. An attacker can exploit this vulnerability by:

1. Creating or compromising an application running within an AppContainer environment
2. Crafting authentication requests that bypass the capability validation checks
3. Leveraging the obtained enterprise authentication capability to authenticate to network resources
4. Accessing domain resources that should be inaccessible to sandboxed applications

The vulnerability does not require user interaction or elevated privileges to exploit. Once exploited, an attacker could potentially harvest domain credentials, access sensitive network resources, or perform lateral movement within the enterprise network.

For detailed technical information about the exploitation mechanism, refer to the Packet Storm Security advisory and the Microsoft Security Advisory.

Detection Methods for CVE-2021-31962

Indicators of Compromise

• Unusual Kerberos authentication requests originating from AppContainer processes that do not have the Enterprise Authentication capability declared in their manifest
• Suspicious network authentication attempts from UWP or sandboxed applications to domain controllers
• Anomalous Kerberos TGT or service ticket requests from processes running under AppContainer tokens
• Event logs showing authentication events from applications that should be capability-restricted

Detection Strategies

• Monitor Windows Security Event Logs (Event IDs 4768, 4769, 4771) for Kerberos authentication attempts from unexpected process contexts
• Implement AppContainer capability auditing to detect applications attempting to use undeclared capabilities
• Deploy network monitoring to identify anomalous Kerberos traffic patterns from sandboxed application sources
• Use endpoint detection tools to correlate AppContainer process execution with network authentication activity

Monitoring Recommendations

• Enable detailed Kerberos authentication logging on domain controllers
• Configure Windows Defender Application Control (WDAC) policies to monitor AppContainer capability usage
• Implement SIEM rules to alert on authentication attempts from known AppContainer process signatures
• Review application manifests to ensure proper capability declarations match expected behavior

How to Mitigate CVE-2021-31962

Immediate Actions Required

• Apply the Microsoft security update released in June 2021 immediately on all affected Windows systems
• Prioritize patching domain controllers and systems hosting sensitive enterprise services
• Review and audit AppContainer applications deployed in the environment for suspicious behavior
• Implement network segmentation to limit potential lateral movement if exploitation occurs

Patch Information

Microsoft has released security updates to address this vulnerability as part of the June 2021 Patch Tuesday release. The patches correct the Kerberos authentication subsystem to properly validate AppContainer capability tokens before granting enterprise authentication access.

Organizations should obtain and apply the appropriate security updates from the Microsoft Security Update Guide. The updates are available through Windows Update, Windows Server Update Services (WSUS), and the Microsoft Update Catalog.

Workarounds

• Implement strict application whitelisting using Windows Defender Application Control (WDAC) to limit which applications can run in AppContainer contexts
• Consider blocking untrusted AppContainer applications until patches can be applied
• Enforce network-level restrictions on Kerberos authentication to limit authentication scope for sandboxed applications
• Enable credential guard where supported to provide additional protection for domain credentials

# Enable Credential Guard via Group Policy (requires compatible hardware)
# Path: Computer Configuration > Administrative Templates > System > Device Guard
# Enable Virtualization Based Security: Enabled
# Credential Guard Configuration: Enabled with UEFI lock

# Verify Credential Guard status
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard