Summary

This affects Windows 10 and 11.
It was possible for an unauthenticated user to access the NVDA python console and get access to a temporary user desktop.
This exploit could only occur:

• when updating/installing Windows screen (Out of Box Experience - OOBE)
• on the "forgot my PIN" reset screen

These screens run on a temporary user desktop.

Patch commit

#14416

Limitations

None

Technical details

The "forgot my PIN" screen and OOBE were previously not considered security, and assumed to run on the secure desktop in secure mode. In Windows 10 and 11, these screens run on a temporary locked desktop, which is indistinguishable from the Windows lock screen. As such they should be handled in the same manner as the Windows lock screen, and prevent access.

Proof of concept

From the secure sign-in screen.

1. Press "I forgot my PIN".
2. Use object navigation to get from the Microsoft Account Window to the Notification Chevron.
3. Enter the overflow notifications area.
4. Find NVDA, press NVDA+enter, route the mouse and click.
5. Press t and p.
6. The NVDA Python Console appears.

Indicators of compromise

Unknown

Workarounds

Unknown

Timeline

Reported mid November 2022
Fix released late December 2022 in 2022.3.3

For more information

If you have any questions or comments about this advisory:

• Email us at [email protected]