CVE-2021-43890

What it actually does

CVE-2021-43890 is a spoofing flaw in Microsoft Windows AppX/App Installer handling, including abuse of specially crafted App Installer packages and the ms-appinstaller URI scheme. An attacker can present a malicious package as if it were a legitimate application, causing a user to install attacker-controlled content. Successful exploitation requires user interaction, typically opening a phishing attachment or link, and code runs in the context of the user who launched the installer; impact is greater when the user has administrative privileges. Microsoft has observed in-the-wild exploitation delivering Emotet, TrickBot, and BazaLoader, which can lead to credential theft, additional payload deployment, lateral movement, and ransomware.

Why it matters to the business

This vulnerability has confirmed active exploitation, appears in CISA KEV, has been associated with ransomware activity, and had a CISA remediation due date of 2021-12-29, so any remaining exposure should be treated as overdue and high priority. For organizations with Windows endpoints, exploitation can turn a phishing click into malware installation, account compromise, operational disruption, data theft, and ransomware deployment. The supplied package metadata also lists Alpine v3.12 mariadb fixed in 10.4.25-r0; because that product mapping does not align with the Windows App Installer vulnerability description, teams should validate scanner/advisory correlation before treating non-Windows package findings as true exposure.

How an attack unfolds

An attacker prepares a malicious App Installer package, MSIX/MSIXBundle, or .appinstaller manifest and hosts it on attacker-controlled infrastructure or sends it as an attachment. The lure is delivered through phishing, malvertising, compromised websites, or messaging platforms and is crafted to appear as a trusted application update, document viewer, collaboration tool, or business utility. When the user opens the attachment or follows a ms-appinstaller link, Windows App Installer processes the package in a way that can misrepresent trust or origin, leading the user to approve installation. The installed package then executes attacker-controlled code under the user’s privileges, commonly staging malware such as Emotet, TrickBot, or BazaLoader. Post-exploitation activity may include persistence, credential harvesting, discovery, command-and-control communication, lateral movement, and ransomware deployment.

How to fix it

Apply Microsoft’s security updates for App Installer and Windows AppX handling. Ensure Microsoft.DesktopAppInstaller is updated from trusted Microsoft sources such as Microsoft Store, Windows Update, enterprise software distribution, or Microsoft’s published App Installer update links. Deploy the December 2023 behavior change or equivalent policy so the ms-appinstaller protocol is disabled by default where not explicitly required. Configure policy at scale to disable the App Installer ms-appinstaller protocol, for example by setting the Desktop App Installer policy to disable EnableMSAppInstallerProtocol. Restrict or block inbound email attachments and web downloads using .appinstaller, .msix, and .msixbundle unless there is a business-approved software distribution process. Use application control such as Microsoft Defender Application Control, AppLocker, or equivalent allowlisting to prevent untrusted package execution. Educate users that App Installer prompts from email or chat links should not be trusted without verification. If vulnerability scanners report Alpine v3.12 mariadb for this CVE, verify the advisory mapping; where that package is genuinely in scope for the scanner’s feed, update mariadb on Alpine v3.12 to 10.4.25-r0 or later, but do not treat that as a substitute for remediating Windows App Installer exposure.

How to confirm the fix worked

Confirm affected Windows endpoints have current Windows updates and an updated Microsoft.DesktopAppInstaller package. Validate with endpoint inventory or PowerShell queries such as Get-AppxPackage Microsoft.DesktopAppInstaller, and compare versions against Microsoft’s fixed release guidance. Confirm the ms-appinstaller URI handler is disabled unless explicitly required and risk-accepted; check enterprise policy and registry locations such as HKLM\SOFTWARE\Policies\Microsoft\Windows\AppInstaller for EnableMSAppInstallerProtocol set to disabled. Test that clicking a ms-appinstaller: URI from a browser or email client does not silently invoke App Installer in an unsafe configuration. Review email gateways, secure web gateways, and EDR controls to confirm .appinstaller, .msix, and .msixbundle files from untrusted sources are blocked, quarantined, or inspected. For scanner results referencing Alpine mariadb, verify that installed packages are at 10.4.25-r0 or later only if that package finding is confirmed relevant by the scanner vendor or distribution advisory.

Typical attack path

1. Attacker crafts a malicious .appinstaller, .msix, or .msixbundle package designed to appear legitimate.
2. Attacker delivers the package or a ms-appinstaller URI through phishing email, chat, web link, or malicious attachment.
3. User opens the link or attachment and is shown a convincing App Installer prompt.
4. User approves the install, allowing the malicious package to execute in the user context.
5. Malware payload is installed or downloaded, often using legitimate Windows processes to blend in.
6. Payload establishes persistence and connects to command-and-control infrastructure.
7. Attacker steals credentials, performs discovery, moves laterally, or deploys additional malware.
8. In ransomware cases, attacker escalates impact by encrypting systems and exfiltrating data.

How to detect it

Hunt across email, proxy, DNS, EDR, and Windows event logs for evidence that users opened App Installer packages from untrusted sources. Prioritize process trees where outlook.exe, winword.exe, excel.exe, teams.exe, slack.exe, chrome.exe, edge.exe, firefox.exe, or iexplore.exe launched AppInstaller.exe, AppInstallerBroker.exe, Add-AppxPackage, powershell.exe, cmd.exe, mshta.exe, wscript.exe, rundll32.exe, regsvr32.exe, or schtasks.exe. Review Microsoft-Windows-AppXDeploymentServer/Operational and Microsoft-Windows-AppInstaller/Operational logs for package installation events around phishing-report timestamps. Search web proxy and firewall logs for ms-appinstaller: URIs, downloads of .appinstaller/.msix/.msixbundle files, and App Installer fetching content from newly registered, low-reputation, or non-corporate domains. Review email security logs for attachments or URLs using App Installer formats, especially messages impersonating software updates, document viewers, package trackers, invoices, or collaboration tools. On endpoints, inspect installed AppX packages, recently staged packages under WindowsApps locations, user package directories, new scheduled tasks, Run keys, services, startup folder entries, and suspicious files created shortly after App Installer execution. Because exploitation has been used to deliver Emotet, TrickBot, and BazaLoader, expand hunting to those malware families’ behaviors: credential theft tooling, browser credential access, suspicious DLL execution, unusual PowerShell, encoded commands, C2 beacons, and lateral movement attempts.

• ms-appinstaller:
• .appinstaller
• .msix
• .msixbundle
• AppInstaller.exe
• AppInstallerBroker.exe
• Microsoft.DesktopAppInstaller_8wekyb3d8bbwe
• Microsoft-Windows-AppXDeploymentServer/Operational
• Microsoft-Windows-AppInstaller/Operational
• Add-AppxPackage
• EnableMSAppInstallerProtocol
• HKLM\SOFTWARE\Policies\Microsoft\Windows\AppInstaller
• %LOCALAPPDATA%\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe
• %ProgramFiles%\WindowsApps
• Emotet
• TrickBot
• Bazaloader
• BazaLoader

What your security team should do

• Treat this as an urgent legacy KEV/ransomware-exploited issue: immediately identify any Windows endpoints where App Installer is outdated or ms-appinstaller remains enabled.
• Patch or update Microsoft.DesktopAppInstaller and Windows components through trusted update channels.
• Disable the ms-appinstaller protocol enterprise-wide unless there is a documented business requirement.
• Block or quarantine .appinstaller, .msix, and .msixbundle files from email, webmail, collaboration tools, and untrusted web sources.
• Hunt for historical execution of AppInstaller.exe or AppInstallerBroker.exe launched from browsers, email clients, or collaboration tools.
• Search for malware follow-on activity associated with Emotet, TrickBot, and BazaLoader, especially credential access, suspicious scheduled tasks, and unusual outbound network connections.
• Use application control to allow only trusted and signed packages from approved publishers and internal software repositories.
• Validate vulnerability scanner mappings where this CVE is reported against non-Windows packages such as Alpine mariadb; update to mariadb 10.4.25-r0 or later only for confirmed applicable package findings.