CVE-2023-24932

MEDIUM

Secure Boot Security Feature Bypass Vulnerability

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-24932 has a selected CVSS score of 6.7 (medium); EIP currently links 4 repository PoCs.

Description

Secure Boot Security Feature Bypass Vulnerability

Description source: GitHub Advisory

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 9, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Repository PoCs
4

CISA SSVC decision

ExploitationActive
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Mar 1, 2023 · Source: CVE List

Affected products and versions

Showing 12 of 28
ProductSourceVersion range

Windows

Browse Microsoft / Windows
VulnCheckVersion data not supplied

Windows 10 Version 1507

Browse Microsoft / Windows 10 Version 1507
CVE List10.0.10240.0 to < 10.0.10240.21073affected

Windows 10 Version 1607

Browse Microsoft / Windows 10 Version 1607
CVE List10.0.14393.0 to < 10.0.14393.8246affected

Windows 10 Version 1809

Browse Microsoft / Windows 10 Version 1809
CVE List10.0.17763.0 to < 10.0.17763.7558affected
10.0.0 to < 10.0.17763.6054affected

Windows 10 Version 20H2

Browse Microsoft / Windows 10 Version 20H2
CVE List10.0.0 to < 10.0.19042.2965affected

Windows 10 Version 21H2

Browse Microsoft / Windows 10 Version 21H2
CVE List10.0.19044.0 to < 10.0.19044.6093affected

Windows 10 Version 22H2

Browse Microsoft / Windows 10 Version 22H2
CVE List10.0.19045.0 to < 10.0.19045.6093affected

Windows 11 Version 23H2

Browse Microsoft / Windows 11 Version 23H2
CVE List10.0.22631.0 to < 10.0.22631.5624affected

Windows 11 Version 24H2

Browse Microsoft / Windows 11 Version 24H2
CVE List10.0.26100.0 to < 10.0.26100.4652affected

Windows 11 version 21H2

Browse Microsoft / Windows 11 version 21H2
CVE List10.0.22000.0 to < 10.0.22000.3079affected

Windows 11 version 22H2

Browse Microsoft / Windows 11 version 22H2
CVE List10.0.22621.0 to < 10.0.22621.5624affected

Windows 11 version 22H3

Browse Microsoft / Windows 11 version 22H3
CVE List10.0.22631.0 to < 10.0.22631.5624affected

Proofs of concept

4

Repository PoCs

GitHubv1ckxy/Orchestrated-Powershell-for-CVE-2023-24932-enRepository PoCby v1ckxy0Scanner3 files

32.5 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A PowerShell script that automates the application of Microsoft's Secure Boot mitigation steps for CVE-2023-24932. It sets registry keys to trigger DB, Boot Manager, DBX, and SVN updates, orchestrates required reboots, and validates the updates by checking for specific Windows Event Log entries. It does not contain code to exploit the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a PowerShell script (CVE-2023-24932-automation.ps1) and its README.md. The script automates Microsoft's documented Secure Boot mitigation steps for CVE-2023-24932 by setting registry keys, scheduling reboots, and checking event logs. No backdoor, trojan, or deceptive behavior is observed. The script performs only the advertised administrative tasks and does not contain concealed executable payloads, credential theft, persistence mechanisms, or unrelated remote access.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPowerShell
Target softwareMicrosoft WindowsWindows Boot ManagerSecure Boot
Attack typesSecurity Feature Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary operation is to apply Microsoft's official mitigation steps for CVE-2023-24932 by setting specific registry keys and then validating the success of these updates by checking the system state (Event Logs, Secure Boot variables). It does not contain any code to exploit the Secure Boot bypass vulnerability. The README describes it as an automation script for the mitigation guidance.

CVE-2023-24932-automation.ps1:1-17README.md:1-4

Requirements

  • Administrator privileges are required to run the script.CVE-2023-24932-automation.ps1:118-124
  • Secure Boot must be enabled on the system.CVE-2023-24932-automation.ps1:127-131

Observed behavior

  • Checks for administrator privileges and exits if not present.CVE-2023-24932-automation.ps1:118-124
  • Verifies that Secure Boot is enabled.CVE-2023-24932-automation.ps1:127-131
  • Sets the 'AvailableUpdates' registry value to 0x40 to trigger a DB update.CVE-2023-24932-automation.ps1:217-218
  • Sets the 'AvailableUpdates' registry value to 0x100 to trigger a Boot Manager update.CVE-2023-24932-automation.ps1:296-297
  • Sets the 'AvailableUpdates' registry value to 0x80 to trigger a DBX update.CVE-2023-24932-automation.ps1:481-482
  • Sets the 'AvailableUpdates' registry value to 0x200 to trigger an SVN update.CVE-2023-24932-automation.ps1:560-561
  • Checks the Windows System Event Log for event ID 1799 to confirm a successful Boot Manager update.CVE-2023-24932-automation.ps1:338
  • Checks the Windows System Event Log for event ID 1037 to confirm a successful DBX update.CVE-2023-24932-automation.ps1:531
  • Reads the Secure Boot 'db' variable to check for the presence of the 'Windows UEFI CA 2023' certificate.CVE-2023-24932-automation.ps1:275-277
  • Reads the Secure Boot 'dbx' variable to check for the presence of the 'Microsoft Windows Production PCA 2011' certificate.CVE-2023-24932-automation.ps1:599
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Registry Persistence
Payload withheldThe script registers itself in RunOnce to resume after reboot, which is necessary for the multi-step Secure Boot update process.CVE-2023-24932-automation.ps1:78-80
Registry Modification
Payload withheldThe script sets DWORD values 0x40, 0x100, 0x80, and 0x200 to trigger Secure Boot updates as per Microsoft guidance.CVE-2023-24932-automation.ps1:217-219CVE-2023-24932-automation.ps1:296-298CVE-2023-24932-automation.ps1:481-483CVE-2023-24932-automation.ps1:560-562
File Copy
Payload withheldCopies the updated boot manager to a local path for optional manual signature verification, consistent with the script's documented purpose.CVE-2023-24932-automation.ps1:392
Review boundaries

What the analysis did not establish

  • One file (LICENSE) was omitted from the evidence packet, but it is unlikely to contain exploit code.
  • The evidence packet reports 'complete_artifact_coverage: false' because the LICENSE file was not included, but all selected text files are complete.
  • One file (unclassified, 139 bytes) was omitted from the text evidence and not analyzed; its content is unknown.
  • Binary content was not inspected; the analysis is limited to the provided readable text files.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubETS-MSE/secure-boot-cert-servicingRepository PoCby ETS-MSE0Scanner3 files

60.6 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A PowerShell script that assesses a Windows machine's Secure Boot certificate posture for the 2011 to 2023 rollover (CVE-2023-24932) and optionally opts the machine into the Microsoft KB5025885 servicing pipeline by writing a registry value. The primary operation is assessment and reporting; exploitation is not performed.

Backdoor review

No backdoor observed in reviewed code

The artifact is a PowerShell script and its README documentation for assessing and servicing the Secure Boot 2011 to 2023 certificate rollover (CVE-2023-24932). The script performs local system assessment, prints a report, and optionally writes a single registry value to opt into Microsoft's KB5025885 servicing pipeline. No network access, credential theft, persistence mechanisms, unrelated payloads, or concealed operator-directed harm were observed. The code is transparent, well-commented, and its behavior aligns with the documented purpose.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPowerShell
Target softwareMicrosoft WindowsSecure Boot
Attack typesSecurity Feature Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary function is to assess the Secure Boot certificate state and report a verdict. It does not contain code to exploit the CVE-2023-24932 vulnerability. The optional -Apply action writes a documented registry value to opt into Microsoft's official servicing pipeline, which is a configuration change, not an exploitation technique. The script is a scanner/assessment tool.

Invoke-SecureBootCertServicing.ps1:3-10Invoke-SecureBootCertServicing.ps1:18-19Invoke-SecureBootCertServicing.ps1:41-50

Requirements

  • Requires Administrator privileges to read UEFI variables and write the servicing registry value.Invoke-SecureBootCertServicing.ps1:119-120
  • Requires Windows PowerShell 5.1.Invoke-SecureBootCertServicing.ps1:1

Observed behavior

  • Reads Secure Boot UEFI variables (db, kek, dbdefault, dbx, pk) to determine the presence of 2011 and 2023 certificates.Invoke-SecureBootCertServicing.ps1:504-534
  • Checks the Authenticode signature of the boot manager (bootmgfw.efi) to determine if it is signed by a 2023 certificate.Invoke-SecureBootCertServicing.ps1:556-562
  • Reads BitLocker state using three independent methods (Get-BitLockerVolume, manage-bde, WMI) and checks for the presence of a recovery password protector.Invoke-SecureBootCertServicing.ps1:215-378
  • When the -Apply switch is used, writes the DWORD value 0x5944 to HKLM\SYSTEM\CurrentControlSet\Control\Secureboot\AvailableUpdates to opt the machine into the servicing pipeline.Invoke-SecureBootCertServicing.ps1:914
  • Refuses to write the 0x80 DBX revocation bit unless -AllowRevocation is explicitly passed.Invoke-SecureBootCertServicing.ps1:847-850
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Registry Write
Payload withheldThe only write operation performed by the script when -Apply is used. This is the documented KB5025885 opt-in value.Invoke-SecureBootCertServicing.ps1:914
No Network Access
Payload withheldConfirms the script does not exfiltrate data or contact remote servers.Invoke-SecureBootCertServicing.ps1:1-1014README.md:48
No Persistence
Payload withheldThe script does not establish any mechanism to survive reboots or maintain access.Invoke-SecureBootCertServicing.ps1:1-1014
No Credential Access
Payload withheldNo credential dumping or key extraction logic present.Invoke-SecureBootCertServicing.ps1:16Invoke-SecureBootCertServicing.ps1:339-359
Review boundaries

What the analysis did not establish

  • Evidence includes only the PowerShell script and README; one file (LICENSE) is omitted as non-text. The analysis is based solely on static review of the provided source code; no dynamic execution or verification was performed.
  • One file (LICENSE) was omitted from the text evidence; it is a standard MIT license file and unlikely to contain executable behavior.
  • Binary files were not present in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHubhelleflo1312/Orchestrated-Powershell-for-CVE-2023-24932Repository PoCby helleflo13121Not analyzed6 files

91.2 KiB

GitHub
PoC details
GitHubajf8729/BlackLotusRepository PoCby ajf87298Not analyzed6 files

70.8 KiB

GitHub
PoC details

References

2