CVE-2022-21913: Windows 10 Auth Bypass Vulnerability

CVE-2022-21913 Overview

CVE-2022-21913 is a security feature bypass vulnerability in the Microsoft Local Security Authority (Domain Policy) Remote Protocol (LSAD). The flaw affects a broad range of Windows client and server releases, including Windows 7 through Windows 11 and Windows Server 2008 through Windows Server 2022. An unauthenticated attacker on the network can exploit the weakness to bypass intended security controls in the LSAD protocol implementation. The issue impacts confidentiality of data handled by the protocol while leaving integrity and availability unaffected. Microsoft addressed the issue through its January 2022 security update cycle.

Critical Impact

Network-adjacent attackers can bypass LSAD protocol security features without authentication or user interaction, exposing sensitive domain policy data across nearly every supported Windows version.

Affected Products

• Microsoft Windows 10 (all supported branches), Windows 11, Windows 7 SP1, Windows 8.1, and Windows RT 8.1
• Microsoft Windows Server 2008 SP2, Server 2008 R2 SP1, Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 20H2, and Server 2022
• Affected component: Local Security Authority (Domain Policy) Remote Protocol (LSAD / lsarpc)

Discovery Timeline

• 2022-01-11 - CVE-2022-21913 published to the National Vulnerability Database
• 2022-01-11 - Microsoft released its security advisory and patch as part of the January 2022 Patch Tuesday
• 2024-11-21 - Last updated in the NVD database

Technical Details for CVE-2022-21913

Vulnerability Analysis

The Local Security Authority (Domain Policy) Remote Protocol exposes RPC interfaces used to query and manage domain security policy objects on Windows systems. CVE-2022-21913 is classified by Microsoft as a security feature bypass that affects the confidentiality of data carried by the protocol. The vulnerability is reachable over the network without prior authentication or user interaction, which makes it accessible from any host that can reach the LSAD RPC endpoint. Because integrity and availability are not impacted, exploitation does not modify policy data or crash the service. Instead, the bypass weakens protections that the protocol is supposed to enforce on sensitive policy information.

Root Cause

NIST classifies the root cause as NVD-CWE-noinfo because Microsoft has not published implementation-level details. The advisory describes the issue as a security feature bypass in the LSAD protocol implementation rather than a memory corruption or input validation flaw. The underlying weakness sits inside the Windows Local Security Authority Subsystem Service (LSASS) component that handles LSAD RPC calls.

Attack Vector

An attacker reaches the LSAD interface over standard Windows RPC transports, typically the \PIPE\lsarpc named pipe over SMB or RPC over TCP. The attacker issues crafted LSAD requests that bypass the protocol's confidentiality protections, allowing access to data that should be restricted. No credentials and no user interaction are required for the request path to succeed.

No verified proof-of-concept code is published for this CVE. Refer to the Microsoft CVE-2022-21913 Advisory for vendor-supplied technical details.

Detection Methods for CVE-2022-21913

Indicators of Compromise

• Unexpected anonymous or low-privileged RPC connections to \PIPE\lsarpc from non-domain hosts or unmanaged endpoints.
• High-volume LSAD RPC method calls such as LsarOpenPolicy, LsarQueryInformationPolicy, or related domain policy queries from a single source.
• Authentication patterns where SMB or RPC sessions to LSASS occur without preceding interactive or service logons.

Detection Strategies

• Hunt for RPC traffic to LSASS named pipes originating from hosts that have no operational reason to query domain policy.
• Correlate Windows Security event ID 5145 (named pipe access) with lsarpc and samr pipe names to surface anomalous LSAD activity.
• Baseline normal LSAD RPC call rates per host and alert on deviations that may indicate enumeration or bypass attempts.

Monitoring Recommendations

• Enable detailed object access auditing on domain controllers and member servers so that LSAD pipe access is logged.
• Forward Microsoft-Windows-LSA and Security channel events to a centralized analytics platform for retention and correlation.
• Monitor SMB sessions to LSASS pipes from workstations to workstations, which is unusual in well-segmented environments.

How to Mitigate CVE-2022-21913

Immediate Actions Required

• Apply the January 2022 Microsoft security updates to every affected Windows client and server build, prioritizing domain controllers and identity infrastructure.
• Inventory hosts still running Windows 7 SP1, Windows 8.1, or Windows Server 2008 / 2008 R2 and confirm that the corresponding extended-support updates are installed.
• Restrict inbound SMB and RPC access to LSASS endpoints from untrusted network segments using host-based and network firewalls.

Patch Information

Microsoft published the fix on 11 January 2022. Update guidance and the per-build patch matrix are available in the Microsoft CVE-2022-21913 Update Guide and the corresponding MSRC advisory portal entry. Patches are delivered through standard Windows Update, WSUS, and the Microsoft Update Catalog.

Workarounds

• Microsoft did not publish a configuration workaround; patching is the supported remediation path.
• Enforce SMB signing and require channel binding for LDAP and RPC to reduce exposure of identity protocols on the network.
• Block inbound TCP/445 and dynamic RPC ports from untrusted networks at the perimeter and between segmented zones.
• Limit which accounts and hosts can reach domain controller RPC interfaces using IPsec or Windows Firewall connection security rules.

# Example: restrict inbound SMB to LSASS from untrusted subnets on a Windows host
New-NetFirewallRule -DisplayName "Block-Untrusted-SMB" `
  -Direction Inbound -Protocol TCP -LocalPort 445 `
  -RemoteAddress 10.99.0.0/16 -Action Block