CVE-2021-40460: Windows 10 Auth Bypass Vulnerability

CVE-2021-40460 Overview

CVE-2021-40460 is a Security Feature Bypass vulnerability affecting the Windows Remote Procedure Call (RPC) Runtime across a wide range of Microsoft Windows operating systems. This vulnerability allows an authenticated attacker to bypass security mechanisms implemented in the RPC Runtime, potentially enabling unauthorized modifications to system integrity without requiring user interaction.

The Windows RPC Runtime is a fundamental Windows component that enables inter-process communication across networks. A security feature bypass in this critical subsystem poses significant risks, as it could allow attackers to circumvent protections that normally prevent unauthorized operations.

Critical Impact

Authenticated attackers can bypass RPC Runtime security features to compromise system integrity across multiple Windows versions, including Windows 7 through Windows 11 and all supported Windows Server editions.

Affected Products

• Microsoft Windows 10 (all versions including 1607, 1809, 1909, 2004, 20H2, 21H1)
• Microsoft Windows 11 (x64 and ARM64)
• Microsoft Windows 7 SP1
• Microsoft Windows 8.1 and Windows RT 8.1
• Microsoft Windows Server 2008 R2 SP1
• Microsoft Windows Server 2012 and 2012 R2
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 2022
• Microsoft Windows Server 20H2

Discovery Timeline

• October 13, 2021 - CVE-2021-40460 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-40460

Vulnerability Analysis

This vulnerability exists within the Windows Remote Procedure Call (RPC) Runtime, a core Windows component responsible for facilitating communication between processes, including across network boundaries. The RPC Runtime implements various security features to ensure that only authorized operations can be performed.

The security feature bypass allows an attacker with low-privilege credentials to circumvent these protective mechanisms. While the vulnerability does not directly expose confidential information or cause system unavailability, it enables high-impact modifications to system integrity. This makes it particularly concerning in enterprise environments where RPC is extensively used for domain operations, authentication services, and distributed computing.

The vulnerability can be exploited remotely over the network without any user interaction, making it suitable for automated attack chains. An attacker who successfully exploits this vulnerability could potentially modify protected data or system configurations that would normally be restricted by RPC security controls.

Root Cause

The root cause of CVE-2021-40460 lies in improper implementation of security feature validation within the Windows RPC Runtime. The vulnerability stems from a flaw in how the RPC Runtime enforces security controls, allowing certain operations to bypass the intended security checks. This type of security feature bypass typically occurs when security validation logic fails to properly verify authorization for specific RPC operations or when certain code paths inadvertently skip security checks.

Attack Vector

The attack vector for CVE-2021-40460 involves network-based exploitation by an authenticated attacker. The attack flow typically follows these steps:

1. The attacker obtains valid credentials for a low-privilege account on the target network
2. The attacker sends specially crafted RPC requests to a vulnerable Windows system
3. Due to the security feature bypass, the RPC Runtime fails to properly enforce security controls
4. The attacker can perform operations that modify system integrity beyond their normal authorization level

The vulnerability does not require user interaction and can be exploited with low attack complexity. The primary impact is to system integrity, as the attacker can make unauthorized modifications, but confidentiality and availability are not directly affected.

Detection Methods for CVE-2021-40460

Indicators of Compromise

• Unusual RPC traffic patterns or connections from unexpected source IP addresses
• Abnormal authentication events followed by RPC-related system modifications
• Security event logs showing unexpected changes to protected system resources
• Evidence of low-privilege accounts performing actions typically requiring higher privileges

Detection Strategies

• Monitor Windows Security Event Logs for RPC-related events (Event IDs 5712, 5713) indicating unusual RPC activity
• Implement network traffic analysis to detect anomalous RPC communication patterns
• Deploy endpoint detection rules to identify processes making suspicious RPC calls
• Utilize SIEM correlation rules to detect authentication events followed by integrity-impacting operations

Monitoring Recommendations

• Enable advanced auditing for RPC and distributed COM operations in Windows Security Policy
• Configure network intrusion detection systems to monitor RPC traffic on TCP port 135 and dynamic RPC ports
• Implement baseline monitoring for normal RPC communication patterns to identify deviations
• Deploy SentinelOne agents with behavioral AI to detect exploitation attempts targeting Windows RPC subsystems

How to Mitigate CVE-2021-40460

Immediate Actions Required

• Apply the Microsoft security update from the October 2021 Patch Tuesday release immediately
• Prioritize patching for systems exposed to untrusted networks or the internet
• Audit network access controls to limit RPC exposure to trusted systems only
• Review and validate accounts with network access to identify potential compromise

Patch Information

Microsoft released security updates addressing CVE-2021-40460 as part of the October 2021 security updates. Organizations should apply the appropriate update for their Windows version from the Microsoft Security Advisory CVE-2021-40460. The patches are available through Windows Update, Microsoft Update Catalog, and Windows Server Update Services (WSUS).

Organizations running Windows 7 SP1 or Windows Server 2008 R2 SP1 should ensure they have Extended Security Updates (ESU) to receive patches for this vulnerability.

Workarounds

• Implement network segmentation to restrict RPC access between security zones
• Configure Windows Firewall to limit RPC traffic to authorized systems and ports only
• Consider disabling unnecessary RPC services on systems where they are not required
• Implement strong authentication requirements and monitor for credential compromise

# Restrict RPC access using Windows Firewall
netsh advfirewall firewall add rule name="Block RPC from untrusted networks" dir=in action=block protocol=tcp localport=135 remoteip=any

# Allow RPC only from trusted subnets
netsh advfirewall firewall add rule name="Allow RPC from trusted subnet" dir=in action=allow protocol=tcp localport=135 remoteip=10.0.0.0/8

# Verify RPC service status
sc query rpcss