CVE-2023-35348

FAQ

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

An attacker would require access to a low privileged session on the user's device to obtain a JWT (JSON Web Token) which can then be used to craft a long-lived assertion using the Windows Hello for Business Key from the victim's device.

According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of integrity (I:H)? What does that mean for this vulnerability?

By exploiting this vulnerability, an attacker can craft a long-lived assertion and impersonate a victim user affecting the integrity of the assertion.

What kind of security feature could be bypassed by successfully exploiting this vulnerability?

An attacker can bypass Windows Trusted Platform Module by crafting an assertion and using the assertion to request a Primary Refresh Token from another device.

What actions do I need to take to be protected from this vulnerability?

To be protected, apply the fix as follows:

Install Windows updates released on or after July 11, 2023 on all AD FS servers of the farm. Then, enable the setting by running the following PowerShell command on the primary AD FS server of the farm:

Set-AdfsProperties-EnforceNonceInJWT Enabled

Important You may see authentication failures in certain scenarios when there are clients that are not updated and send JWT authentication requests to the AD FS server. In such cases, we recommend updating all clients by installing the Windows update released on or after July 11, 2023. Alternatively, an administrator can disable the EnforceNonceInJWT setting and monitor the AD FS servers for the logging of Event 187 to identify potential requests that could be rejected when EnforceNonceInJWT is set to Enabled. After confirming the absence of Event 187 on AD FS servers for a defined period of time, the EnforceNonceInJWT setting must be updated to Enabled.