CISA adds Microsoft Windows Print Spooler flaw to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-38028 | Local Privilege Escalation in Microsoft Windows Print Spooler (CVE-2022-38028) CVE-2022-38028 is an elevation-of-privilege vulnerability (CVSS 3.1: 7.8) in the Microsoft Windows Print Spooler, the service that manages print jobs on Windows machines. An attacker who can already run low-privileged code on a vulnerable system can exploit the flaw locally, with no user interaction required, to escalate to SYSTEM privileges and take full control of the host (high confidentiality, integrity, and availability impact). It affects a broad set of Windows releases — Windows 10 builds 1507 through 21H2, Windows 11 22H2, Windows 8.1 and Windows RT 8.1, and Windows Server 2012, 2016, and 2019 — so most unpatched Windows estates are in scope. Exploitation is confirmed in the wild: CISA added the bug to the KEV catalog on 2024-04-23 (ransomware use unknown), and public reporting attributes active use to the Russia-linked APT28 group, whose custom 'GooseEgg' tool leverages this NSA-reported flaw to run payloads with elevated privileges; Microsoft shipped the fix in its April 2024 Patch Tuesday. EPSS is 14.9% (96th percentile), indicating elevated near-term exploitation risk on top of the already-observed APT28 activity. Do: Apply Microsoft's security updates for the affected Windows releases (fixed in the April 2024 Patch Tuesday); as a KEV entry, CISA requires applying vendor mitigations or discontinuing use of unpatched versions. On servers where printing is not required, disabling the Print Spooler service removes the local attack path. Given confirmed APT28 use of the 'GooseEgg' exploit, hunt for related activity on unpatched hosts and prioritize patching endpoints belonging to organizations and users targeted by APT28. | 7.8 | 15% | KEV |
| masshundreds of millions of Windows 10/11 endpoints plus millions of Windows Server hosts (every unpatched install of the listed releases) |
Full article325 words · extracted from securityaffairs.com · click to collapse
U.S. CISA added the Windows Print Spooler flaw CVE-2022-38028 to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE-2022-38028 Microsoft Windows Print Spooler Privilege Escalation vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
Cisa added the flaw to the KEV catalog after Microsoft reported that the Russia-linked APT28 group (aka “Forest Blizzard”, “Fancybear” or “Strontium” used a previously unknown tool, dubbed GooseEgg, to exploit the Windows Print Spooler flaw CVE-2022-38028.
Since at least June 2020, and possibly earlier, the cyberespionage group has used the tool GooseEgg to exploit the CVE-2022-38028 vulnerability. This tool modifies a JavaScript constraints file and executes it with SYSTEM-level permissions. Microsoft has observed APT28 using GooseEgg in post-compromise activities against various targets, including government, non-governmental, education, and transportation sector organizations in Ukraine, Western Europe, and North America.
While GooseEgg is a simple launcher application, threat actors can use it to execute other applications specified at the command line with elevated permissions. In a post-exploitation scenario, attackers can use the tool to carry out a broad range of malicious activities such as remote code execution, installing backdoors, and moving laterally through compromised networks.
The vulnerability CVE-2022-38028 was reported by the U.S. National Security Agency and Microsoft addressed it with the release of Microsoft October 2022 Patch Tuesday security updates.
APT28 deployed GooseEgg to gain elevated access to target systems and steal credentials and sensitive information.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by May 14, 2024.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/162295/hacking/cisa-adds-microsoft-windows-print-spooler-flaw-to-its-known-exploited-vulnerabilities-catalog.html