CVE-2024-21390: Microsoft Authenticator Elevation Vulnerability

CVE-2024-21390 Overview

CVE-2024-21390 is an elevation of privilege vulnerability affecting Microsoft Authenticator, the widely-used multi-factor authentication (MFA) application. This vulnerability allows an attacker with local access to potentially elevate their privileges, compromising the confidentiality and integrity of authentication credentials stored within the application.

Critical Impact

Successful exploitation could allow attackers to bypass authentication controls and gain unauthorized access to accounts protected by Microsoft Authenticator, potentially compromising enterprise and personal authentication workflows.

Affected Products

• Microsoft Authenticator (all versions prior to patch)

Discovery Timeline

• 2024-03-12 - CVE-2024-21390 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21390

Vulnerability Analysis

This elevation of privilege vulnerability in Microsoft Authenticator stems from an improper authentication weakness (CWE-287). The vulnerability requires local access to the target device and user interaction to exploit, meaning an attacker must already have some level of access to the system where Microsoft Authenticator is installed.

The attack exploits flaws in how the application validates authentication or authorization decisions. Once exploited, an attacker can gain elevated privileges within the context of the Authenticator application, potentially accessing stored authentication tokens, one-time passwords (OTPs), or other sensitive credentials managed by the app.

Root Cause

The root cause of CVE-2024-21390 is categorized as Improper Authentication (CWE-287). This weakness indicates that the Microsoft Authenticator application does not properly verify user identity or authorization in certain scenarios, allowing an attacker to bypass security controls that should prevent unauthorized privilege escalation.

Attack Vector

The attack vector for this vulnerability is local, meaning an attacker needs either physical access to the device or prior compromise of the system through malware or another attack vector. User interaction is required for successful exploitation, which could involve social engineering tactics to convince users to perform specific actions.

The exploitation scenario typically involves:

1. An attacker gaining initial access to a device with Microsoft Authenticator installed
2. Leveraging the authentication bypass to escalate privileges within the application
3. Accessing sensitive authentication data that could be used for account takeover

Detection Methods for CVE-2024-21390

Indicators of Compromise

• Unexpected modifications to Microsoft Authenticator application files or data storage
• Unusual process behavior or privilege escalation attempts associated with the Authenticator app
• Anomalous authentication attempts using credentials that may have been extracted from a compromised device

Detection Strategies

• Monitor mobile device management (MDM) solutions for unauthorized changes to Microsoft Authenticator configurations
• Implement endpoint detection and response (EDR) capabilities to identify suspicious local privilege escalation activities
• Review authentication logs for anomalies that could indicate compromised MFA credentials

Monitoring Recommendations

• Enable detailed logging for Microsoft Entra ID (Azure AD) sign-in events to detect suspicious authentication patterns
• Configure alerts for multiple failed authentication attempts followed by successful logins from new locations
• Monitor for unusual app store activity or sideloading attempts on managed devices

How to Mitigate CVE-2024-21390

Immediate Actions Required

• Update Microsoft Authenticator to the latest version from official app stores immediately
• Review device security policies to ensure only managed and secure devices can access corporate resources
• Audit accounts that may have been accessed from potentially compromised devices
• Consider implementing additional security controls such as Conditional Access policies

Patch Information

Microsoft has addressed this vulnerability through updates to the Microsoft Authenticator application. Organizations and users should ensure they are running the latest version of the application available through the Google Play Store (Android) or Apple App Store (iOS). For detailed patch information, refer to the Microsoft Security Update Guide.

Workarounds

• Restrict physical access to devices with Microsoft Authenticator installed
• Implement mobile device management (MDM) policies to prevent unauthorized application modifications
• Enable device encryption and strong authentication mechanisms (biometrics, PIN) on all devices running Microsoft Authenticator
• Consider using hardware security keys as an alternative or supplementary MFA method for high-value accounts

# Example: Verifying Microsoft Authenticator version on managed devices
# Use your MDM solution to query installed app versions
# Ensure Microsoft Authenticator is updated to the latest available version
# Check vendor advisory for specific patched version numbers