Insecure cryptographic storage in Defender - #VU20850
Published: September 4, 2019
Vulnerability identifier: #VU20850
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-310
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to the software stores token seeds, PAP secrets, and user passwords in Active Directory attributes. Defender passwords are hashed using MD5 in conjunction with a static key for obfuscation, which allows a remote authenticated user to read the computed hash from the defender-user TokenData attribute in Active Directory and then use it in an offline brute force attack.
Affected software
Defender
Remediation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.