CVE-2021-43893
📋 TL;DR
This vulnerability in Windows Encrypting File System (EFS) allows authenticated attackers to upload arbitrary files to privileged locations via EFSRPC, potentially leading to privilege escalation. It affects Windows systems with EFS enabled. Attackers need local access to exploit this flaw.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 11 by Microsoft
Windows 11 by Microsoft
Windows 7 by Microsoft
Windows 7 by Microsoft
Windows 8.1 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
Windows Server by Microsoft
Windows Server by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling installation of malware, data theft, and persistent backdoors.
Likely Case
Local privilege escalation from standard user to SYSTEM/administrator, allowing execution of arbitrary code with highest privileges.
If Mitigated
Limited impact with proper network segmentation, least privilege principles, and endpoint protection blocking suspicious file writes.
🎯 Exploit Status
Exploit requires local authenticated access; public exploit code available on Packet Storm and other security sites.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: January 2022 security updates (KB5009543 for Windows 10 21H2, KB5009557 for Windows Server 2022, etc.)
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43893
Restart Required: Yes
Instructions:
1. Apply January 2022 Windows security updates via Windows Update. 2. For enterprise: Deploy patches through WSUS or SCCM. 3. Verify installation via 'systeminfo' command showing appropriate KB installed.
🔧 Temporary Workarounds
Disable EFSRPC via Registry
windowsPrevents exploitation by disabling the vulnerable EFSRPC interface
reg add "HKLM\SYSTEM\CurrentControlSet\Services\EFS" /v "Start" /t REG_DWORD /d 4 /f
Restrict EFSRPC Access with Firewall
windowsBlocks network access to EFSRPC endpoints
netsh advfirewall firewall add rule name="Block EFSRPC" dir=in action=block protocol=TCP localport=445,139
🧯 If You Can't Patch
- Implement strict network segmentation to limit lateral movement
- Enforce least privilege principles and monitor for suspicious file writes to system directories
🔍 How to Verify
Check if Vulnerable:
Check if January 2022 security updates are NOT installed via 'systeminfo | findstr /C:"KB5009543" /C:"KB5009557"' (returns empty if vulnerable)Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Confirm January 2022 updates are installed: 'systeminfo | findstr /C:"KB5009543" /C:"KB5009557"' should show installed KB numbers📡 Detection & Monitoring
Log Indicators:
- Windows Security Event ID 4663 (File system access) showing unauthorized writes to system directories
- Sysmon Event ID 11 (FileCreate) for suspicious file creation in privileged locations
Network Indicators:
- Unusual RPC calls to EFS endpoints (\pipe\efsrpc)
- SMB traffic to system shares from non-admin accounts
SIEM Query:
source="windows" (event_id=4663 OR event_id=11) AND (target_object="*\\Windows\\*" OR target_object="*\\Program Files\\*") AND user NOT IN ("SYSTEM", "Administrators")🔗 References
- http://packetstormsecurity.com/files/165560/Microsoft-Windows-EFSRPC-Arbitrary-File-Upload-Privilege-Escalation.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43893
- http://packetstormsecurity.com/files/165560/Microsoft-Windows-EFSRPC-Arbitrary-File-Upload-Privilege-Escalation.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43893
