PoC for critical Windows Print Spooler flaw leaked (CVE-2021-1675)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-1675 | Remote Code Execution in Microsoft Windows Print Spooler (PrintNightmare) CVE-2021-1675 is a code execution flaw in the Windows Print Spooler service affecting the listed Windows 10, 7, 8.1, RT 8.1 and Windows Server editions. It is triggered through print operations processed by the spooler, notably print driver handling; the public PoC demonstrates DLL injection into the spooler, allowing an attacker to run arbitrary code with the privileges of the spooler service, typically SYSTEM. Successful exploitation yields full system compromise: installing programs, viewing or deleting data, creating accounts, and lateral movement into domains, which is why it has been widely used as a ransomware entry vector. Any Windows system with the Print Spooler service enabled is exposed, and the service runs by default on servers, domain controllers, and most workstations. Exploitation is confirmed in the wild: a public PoC is available, the flaw was weaponized by the Magniber and Vice Society ransomware groups, it was added to CISA KEV on 2021-11-03 with known ransomware use, and Microsoft issued out-of-band fixes after it was being exploited in the wild. Do: Apply Microsoft's out-of-band security updates immediately on all affected Windows client and server systems (per CISA KEV required action), prioritizing domain controllers and print/file servers. As an interim mitigation, disable the Print Spooler service on hosts that do not need printing (e.g., domain controllers) and restrict RPC/network access to the spooler on systems that must keep it running. Check for compromise by looking for unexpected DLL or driver files loaded by the spooler, spoolsv.exe spawning unusual child processes, and ransomware indicators given documented Magniber and Vice Society abuse. | 7.8 | 86% | KEV ransomware PoC |
| masshundreds of millions of Windows endpoints and servers (Print Spooler runs by default across the 1B+ device Windows installed base) | |
| CVE-2021-34527 | PrintNightmare: Remote Code Execution in Microsoft Windows Print Spooler CVE-2021-34527, widely known as 'PrintNightmare', is a remote code execution flaw in the Microsoft Windows Print Spooler service, which improperly performs privileged file operations such as loading printer driver DLLs. An attacker with low-level access who can reach a machine's spooler, for example a domain user able to add a printer connection via Point and Print, can induce the SYSTEM-privileged service to load an attacker-controlled DLL with no user interaction required (CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N). Successful exploitation yields arbitrary code execution as SYSTEM, letting the attacker install programs, view, change or delete data, and create new accounts with full user rights, effectively achieving complete host compromise. The flaw affects all supported Windows client and server releases in the CISA data, Windows 10 from 1507 through 22H2, Windows 11, Windows RT 8.1, and Windows Server 2008, 2012 and 2016, wherever the Print Spooler service is running. Exploitation is confirmed in the wild: the bug was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, the FBI and CISA have warned of Russian actors exploiting it, and EPSS places the 30-day exploitation probability at 99.8%. Do: Install the July 2021 security updates immediately, released July 6, 2021 with additional updates on July 7 for Windows Server 2012, Windows Server 2016 and Windows 10 version 1607, and review KB5005010 for restricting installation of new printer drivers after applying the July 6 updates. Where patching is delayed, disable the Print Spooler service on hosts that do not need printing or restrict Point and Print, and verify that NoWarningNoElevationOnInstall and UpdatePromptSettings under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint are set to 0 or not defined (these keys do not exist by default, which is the secure state; NoWarningNoElevationOnInstall = 1 makes the system vulnerable by design). Prioritize domain controllers and servers with exposed spoolers, and hunt… | 8.8 | 100% | KEV ransomware PoC ×3 |
| masshundreds of millions of Windows systems (order of magnitude 10^8) |
Full article703 words · extracted from helpnetsecurity.com · click to collapse
CVE-2021-1675, a Windows Print Spooler vulnerability that Microsoft patched in June 2021, presents a much greater danger than initially thought: researchers have proved that it can be exploited to achieve remote code execution and – what’s worse – PoC exploits have since been leaked.
About CVE-2021-1675
Credited to Zhipeng Huo of Tencent Security Xuanwu Lab, Piotr Madej of AFINE and Yunhai Zhang of NSFOCUS TIANJI Lab, CVE-2021-1675 was initially classed as low severity vulnerability, allowing local privilege elevation, and was patched on June 2021 Patch Tuesday.
But on June 21, 2021, Microsoft changed the classification because it was discovered that the flaw allows for remote code execution (RCE), and it was re-classified as critical.
Then, on June 27, the researchers from Chinese cybersecurity company QiAnXin shared on Twitter a video/GIF demonstrating an exploit for the vulnerability to achieve RCE.
Two days later, researchers from Sangfor Technologies published and then quickly deleted technical details and a PoC exploit for CVE-2021-1675, but not before the GitHub repository where they put it was cloned / forked.
What now?
CVE-2021-1675 affects various versions of Windows Server (2004, 2008, 2008 R2, 2012, 2012 R2, 2016, 2019, 20H2) and Windows (7, 8.1, RT 8.1, 10).
The Windows Print Spooler is an application / interface / service that interacts with local or networked printers and manages the printing process.
It is an old Windows component (20+ years) and researchers find bugs in it often. Occasionally, threat actors do it, too: the attackers behind the infamous Stuxnet malware leveraged, among other bugs, a “lowly” privilege escalation vulnerability in the Windows Print Spooler service.
Copied and modified PoC exploits for CVE-2021-1675 will be widely available soon. In fact, forks and specific implementations can already be found online. So, for those organizations that haven’t yet implemented the available patch, time is now of the essence.
UPDATE (June 30, 2021, 08:25 a.m. PT):
Apparently, the patch for CVE-2021-1675 released earlier this month might not be enough to foil the zero-day PoC (“PrintNightmare”) available:
Fully patched Windows 2019 domain controller, popped with 0day exploit (CVE-2021-1675) from a regular Domain User's account giving full SYSTEM privileges. Disable "Print Spooler" service on servers that do not require it. pic.twitter.com/6SUVQYy5Tl
— Hacker Fantastic (@hackerfantastic) June 30, 2021
Until Microsoft clears up the confusion and releases another patch, disabling the “Print Spooler” service on machines that don’t need it is a good idea.
This is very important!
If you have the "Print Spooler" service enabled (which is the default), any remote authenticated user can execute code as SYSTEM on the domain controller.
Stop and Disable the service on any DC now! https://t.co/hl0NItsrBF pic.twitter.com/s4yE2VVl5I
— Will Dormann (@wdormann) June 30, 2021
UPDATE (July 2, 2021, 11:35 a.m. PT):
Microsoft has assigned a new CVE to this so-called PrintNightmare vulnerability: CVE-2021-34527.
“A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attack must involve an authenticated user calling RpcAddPrinterDriverEx(),” Microsoft explained.
“Domain controllers are affected. We are still investigating if other types of roles are also affected. This vulnerability is similar but distinct from the vulnerability that is assigned CVE-2021-1675, which addresses a different vulnerability in RpcAddPrinterDriverEx(). The attack vector is different as well. CVE-2021-1675 was addressed by the June 2021 security update.”
While we wait for patches, Microsoft has offered the following workarounds for mitigating the risk of exploitation: disable the Print Spooler service or disable inbound remote printing through Group Policy.
UPDATE (July 9, 2021, 1:20 a.m. PT):
Microsoft has issued an out of band fix for CVE-2021-34527, first for some and then for all supported Windows and Windows Server versions, and advised on additional steps to take after implementing the security updates to make sure the system is secure. There have been reports that the security updates can be bypassed, but Microsoft said that their investigation “has shown that the OOB security update is working as designed and is effective against the known printer spooling exploits and other public reports collectively being referred to as PrintNightmare.”
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/06/30/poc-cve-2021-1675/