QID 91848

Date Published: 2021-12-15

QID 91848: Windows AppX Installer Spoofing Vulnerability

CVE-2021-43890: Windows AppX Installer Spoofing Vulnerability

Affected Products:
Windows 10 version Windows 10 version 1809 and later.
Windows 10 version 1709 or Windows 10 version 1803.

QID Detection Logic (authenticated):
The detection gets the version of Microsoft.DesktopAppInstaller by querying wmi class Win32_InstalledStoreProgram.

An attacker could craft a malicious attachment to be used in phishing campaigns

CVSS V3 rated as High - 7.1 severity.

CVSS V2 rated as High - 6 severity.

Solution

Please refer to the CVE-2021-43890.

Workaround:
Option1: Enable the following GPO to prevent non-admins from installing any Windows App packages. BlockNonAdminUserInstall- This policy setting manages the ability of non-administrator users to install (signed) Windows app packages. When enabled (value: 1), non-administrator users will be unable to initiate the installation of (signed) Windows app packages.
Option2: Enable this GPO to prevent installing apps from outside the Microsoft Store AllowAllTrustedAppToInstall- This policy setting allows you to manage the installation of trusted line-of-business (LOB) or developer-signed Windows Store apps.If you enable this policy setting, you can install any LOB or developer-signed Windows Store app (which must be signed with a certificate chain that can be successfully validated by the local computer)
Option3: Disable the ms-appinstaller protocol to install apps directly from a website. ms-appinstaller- This will block all attempts to invoke the protocol from the browser. Specifically, how that looks to the user will depend on the construction of the page that tries to launch the protocol.

Vendor References

CVE-2021-43890 - msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43890

CVEs related to QID 91848

CVE-2021-43890 |

Software Advisories

Advisory ID	Software	Component	Link
CVE-2021-43890			msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43890

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].