PT-2021-6408 · Microsoft · Windows+1

Andrew Brandt + 2 · Published 2021-11-16 · Updated 2026-02-24 · CVE-2021-43890

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft App Installer versions prior to 1.21.3421.0

Description The issue is related to a spoofing vulnerability in the AppX installer that affects Microsoft Windows. This vulnerability can be exploited by attackers using specially crafted packages that include malware, such as Emotet/Trickbot/Bazaloader. An attacker could craft a malicious attachment to be used in phishing campaigns, and users with administrative user rights are more impacted than those with fewer user rights. Microsoft has seen an increase in activity from threat actors leveraging social engineering and phishing techniques to target Windows OS users and utilizing the ms-appinstaller URI scheme. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For versions prior to 1.21.3421.0, update the App Installer to build 1.21.3421.0 or greater. As a temporary workaround, consider disabling the ms-appinstaller protocol handler to minimize the risk of exploitation. Restrict access to the ms-appinstaller URI scheme to protect the system from this vulnerability. Avoid using the ms-appinstaller protocol handler until the issue is resolved.

Exploit

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

CWE-264

Related Identifiers

BDU:2022-01515

CVE-2021-43890

Affected Products

Apkinstaller

Windows

References · 30

• 🔥 https://microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer · Exploit
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43890 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-43890 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43890 · Security Note
• https://bdu.fstec.ru/vul/2022-01515 · Security Note
• https://github.com/ChrisTitusTech/winutil/pull/26 · Note
• https://t.me/cvenotify/81393 · Telegram Post
• https://twitter.com/wdormann/status/1740471140483760261 · Twitter Post
• https://cybersecurity-help.cz/vdb/SB2021112505 · Note
• https://twitter.com/XynikIT/status/1740453201084555498 · Twitter Post
• https://t.me/cveNotify/153038 · Telegram Post
• https://twitter.com/wdormann/status/1740496848635437248 · Twitter Post
• https://twitter.com/etguenni/status/1740546580044796265 · Twitter Post
• https://twitter.com/pacificseclabs/status/1757584075077083416 · Twitter Post