PoC exploit accidentally leaks for dangerous Windows PrintNightmare bug
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2020-1337 | An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system. NVD description · AI analysis pending | 7.8 | 14% | PoC ×2 |
| — | |
| CVE-2021-1675 | Remote Code Execution in Microsoft Windows Print Spooler (PrintNightmare) CVE-2021-1675 is a code execution flaw in the Windows Print Spooler service affecting the listed Windows 10, 7, 8.1, RT 8.1 and Windows Server editions. It is triggered through print operations processed by the spooler, notably print driver handling; the public PoC demonstrates DLL injection into the spooler, allowing an attacker to run arbitrary code with the privileges of the spooler service, typically SYSTEM. Successful exploitation yields full system compromise: installing programs, viewing or deleting data, creating accounts, and lateral movement into domains, which is why it has been widely used as a ransomware entry vector. Any Windows system with the Print Spooler service enabled is exposed, and the service runs by default on servers, domain controllers, and most workstations. Exploitation is confirmed in the wild: a public PoC is available, the flaw was weaponized by the Magniber and Vice Society ransomware groups, it was added to CISA KEV on 2021-11-03 with known ransomware use, and Microsoft issued out-of-band fixes after it was being exploited in the wild. Do: Apply Microsoft's out-of-band security updates immediately on all affected Windows client and server systems (per CISA KEV required action), prioritizing domain controllers and print/file servers. As an interim mitigation, disable the Print Spooler service on hosts that do not need printing (e.g., domain controllers) and restrict RPC/network access to the spooler on systems that must keep it running. Check for compromise by looking for unexpected DLL or driver files loaded by the spooler, spoolsv.exe spawning unusual child processes, and ransomware indicators given documented Magniber and Vice Society abuse. | 7.8 | 86% | KEV ransomware PoC |
| masshundreds of millions of Windows endpoints and servers (Print Spooler runs by default across the 1B+ device Windows installed base) |
Full article845 words · extracted from therecord.media · click to collapse
Proof-of-concept exploit code has been published online today for a vulnerability in the Windows Print Spooler service that can allow a total compromise of Windows systems. Tracked as CVE-2021-1675, the vulnerability was patched earlier this month in the Microsoft June 2021 Patch Tuesday security updates. The vulnerability impacts Print Spooler (spoolsv.exe), a Windows service that serves as a generic universal interface between the Windows OS, applications, and local or networked printers, allowing app developers to easily initiate print jobs. The service has been included in Windows since the 90s and is one of the operating system's most buggy processes, with many vulnerabilities being discovered across the years, including bugs such as PrintDemon, FaxHell, Evil Printer, CVE-2020-1337, and even some of the zero-days used in the Stuxnet attacks. CVE-2021-1675, the latest in this long line of Print Spooler bugs, and was initially discovered by security researchers from Tencent Security, AFINE, and NSFOCUS earlier this year. The bug was initially categorized as a low-importance elevation-of-privilege vulnerability that allowed attackers to gain admin privileges, but last week, Microsoft updated the bug's description to classify CVE-2021-1675 as a remote code execution issue that could be remotely exploited to allow attackers to take full control of unpatched Windows systems. Initially, no technical write-up or proof-of-concept code was published for CVE-2021-1675, meaning that attackers who wanted to abuse this bug had to investigate the patch code themselves and create an exploit if they wanted to integrate this bug in their attacks. Last week, Chinese security firm QiAnXin published a low-quality GIF showing an exploit for the CVE-2021-1675 bug for the first time, but the company did not release any technical details or a working PoC in order to allow users more time to apply this month's security updates and safeguard their systems. Recently, we found right approaches to exploit #CVE-2021-1675 successfully, both #LPE and #RCE. It is interesting that the vulnerability was classified into #LPE only by Microsoft, however, it was changed into Remote Code Execution recently.https://t.co/PQO3B12hoE pic.twitter.com/kbYknK9fBw However, in what looks to have been an accident, an in-depth technical write-up and a fully working PoC exploit were shared on GitHub earlier today. The GitHub repo has been taken offline after a few hours, but not before it was cloned by several other users. Authored by three analysts from Chinese security firm Sangfor, the write-up, which we will not link here, details how the trio discovered the bug independently from the teams who reported the vulnerability to Microsoft. "We also found this bug before and hoped to keep it secret to participate in the Tianfu Cup [hacking contest]," the team said today [quote lightly redacted for readability]. The researchers said that since QiAnXin published a video of the CVE-2021-1675 exploit, they decided to publish their full write-up and PoC as a result. However, the team went back on their decision a few hours later after realizing they were giving away the entire details of a talk they had scheduled for the Black Hat USA 2021 security conference later this year. The team pulled the GitHub repo, but by that time, the CVE-2021-1675 exploit and write-up had already been cloned. As seen by The Record, the write-up and the PoC are now being shared in closed infosec communities and are expected to leak back into the public domain again in the coming days. Since the CVE-2021-1675 vulnerability, which the Sangfor team codenamed PrintNightmare, has been revised by Microsoft into an RCE attack vector, and PoC exploit code is now in the public domain, companies are advised to update their Windows fleets as soon as possible. Of note is that the vulnerability impacts all Windows OS versions available today and might even affect deprecated Windows versions such as XP and Vista. Since Print Spooler bugs have been abused in attacks in the past, the chances are pretty high that this bug would be abused as well, especially since it's an RCE, a vulnerability class prized by most attackers. In preparation for possible future abuses, Florian Roth of Nextron Systems has released Sigma rules to detect PrintNightmare exploitation. Update on June 30, 2021: As several security researchers have confirmed after this article went live, the Microsoft patch for CVE-2021-1675 only patches the elevation of privilege attack vector, but not the RCE angle, as Microsoft appears to have bundled two different security flaws under the same CVE identifier. As a result of this discovery, patching Windows systems does not protect them from attacks, and, instead, system administrators are advised to disable the Print Spooler service, especially on Windows servers running as domain controllers from where attackers can pivot to entire internal networks.Vulnerability allows remote code execution
Vulnerability codenamed PrintNightmare
No previous article
No new articles
Catalin Cimpanu
is a cybersecurity reporter who previously worked at ZDNet and Bleeping Computer, where he became a well-known name in the industry for his constant scoops on new vulnerabilities, cyberattacks, and law enforcement actions against hackers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/poc-released-for-dangerous-windows-printnightmare-bug