Microsoft’s April 2021 Patch Tuesday Addresses 108 CVEs (CVE-2021-28310)

CVE-2021-28480, CVE-2021-28481, CVE-2021-28482 and CVE-2021-28483 | Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2021-28480, CVE-2021-28481, CVE-2021-28482 and CVE-2021-28483 are four RCE vulnerabilities in Microsoft Exchange Server. Discovery of these four flaws is credited to the National Security Agency (NSA). Two of the four flaws, CVE-2021-28480 and CVE-2021-28481, are pre-authentication vulnerabilities, which means they can be exploited by remote, unauthenticated attackers without the need for any user interaction.

While no public proof-of-concept (PoC) or in the wild exploitation of these vulnerabilities has been reported, these patches follow the disclosure of four zero-day vulnerabilities in Exchange that were widely exploited following their release in an out-of-band (OOB) update in March, just a week prior to the March 2021 Patch Tuesday release. Microsoft Exchange is undoubtedly a popular target for attackers and security researchers alike with several teams demonstrating successful exploit attempts against Exchange at the Zero Day Initiative’s annual Pwn2Own competition. Considering the widespread exploitation of the last batch of Exchange Server vulnerabilities and the severity of these newly disclosed flaws, administrators should place these at the top of their patching priority list.

CVE-2021-28310 | Win32k Elevation of Privilege Vulnerability

CVE-2021-28310 is an EoP vulnerability in the Desktop Window Manager or dwm.exe. The vulnerability has been exploited in the wild as a zero-day according to researchers at Kaspersky, who shared details about the flaw in a blog post. Kaspersky says this EoP vulnerability has likely been exploited by “several threat actors” and chained together with other browser-based exploits in order to escape sandboxes.

It remains unclear whether this particular zero-day was used in conjunction with a separate browser-based zero-day or unpatched browser-based vulnerabilities. It wouldn’t surprise us to see threat actors leveraging this vulnerability with a browser-based zero-day, as a majority of zero-day vulnerabilities disclosed last year were in browsers, according to findings from our 2020 Threat Landscape Retrospective report.

CVE-2021-28329, CVE-2021-28330, CVE-2021-28331, CVE-2021-28332, CVE-2021-28333, CVE-2021-28334, CVE-2021-28335, CVE-2021-28336, CVE-2021-28337, CVE-2021-28338, CVE-2021-28339 and CVE-2021-28343 | Remote Procedure Call Runtime Remote Code Execution Vulnerability

CVE-2021-28329, CVE-2021-28330, CVE-2021-28331, CVE-2021-28332, CVE-2021-28333, CVE-2021-28334, CVE-2021-28335, CVE-2021-28336, CVE-2021-28337, CVE-2021-28338, CVE-2021-28339 and CVE-2021-28343 are twelve RCE vulnerabilities in the remote procedure call (RPC) runtime in Microsoft Windows. These critically rated CVEs were reported to Microsoft by Yuki Chen, head of the 360 Vulnerability Research Group and 360 Vulcan Team. Chen is responsible for reporting all of the 27 RPC vulnerabilities in Microsoft's April 2021 Patch Tuesday (table below) and was also responsible for the disclosure of 9 RPC vulnerabilities addressed in Microsoft's January 2021 Patch Tuesday. All 27 vulnerabilities were assigned a CVSSv3 score of 8.8 and highlighted by Microsoft as “Exploitation Less Likely.” Exploitation of these vulnerabilities would require network access and a low privileged account based on Microsoft’s assigned CVSSv3 scores.