The “Print Nightmare” bug may not be fully patched, some experts are warning, leaving the door open for widespread remote code-execution attacks.
A proof-of-concept for a critical Windows security vulnerability that allows remote code execution (RCE) was dropped on GitHub on Tues. & while it was taken back down within a few hours, the code was copied & is still out there circulating on the platform.
Elevation-of-Privilege
The bug (CVE-2021-1675) exists in the Windows Print Spooler & has been dubbed “Print Nightmare” by researchers. It was originally addressed in June’s Patch Tues. updates from Microsoft as a minor elevation-of-privilege vulnerability, but the listing was updated last week to “critical” status after researchers from Tencent & NSFOCUS TIANJI Lab figured out it could be used for RCE.
On Sun., the QiAnXin security team tweeted a video showing successful RCE – but it held back any technical or PoC details. 2 days later, though, a full-blown PoC with a complete technical analysis appeared on GitHub, authored by another security firm, Sangfor.
Publicly Available
Claire Tills, Senior Security Engineer with Tenable, which spotted the PoC posting, noted that “the GitHub repository was publicly available long enough for others to clone it. The PoC is likely still circulating & is likely to resurface publicly, if it hasn’t already done so.”
According to 1 security practitioner, the code was successfully forked to another page.
Looks like the original PoC for Print Nightmare (CVE-2021-1675) got deleted but someone has forked it since https://t.co/8MiP62SlzC
— Andy Gill (@ZephrFish) June 29, 2021
On Wed., other researchers tweeted videos & more analysis that could be used for successful exploitation as word spread of the PoC.
Impacket implementation of CVE-2021-1675 🔥https://t.co/UpKOueij4c
— Cube0x0 (@cube0x0) June 29, 2021
Full Remote Takeover
Successful exploitation of CVE-2021-1675 could open the door to complete system takeover by remote adversaries. However, to achieve that requires a targeted user to be authenticated to the spooler service.
“This vulnerability can provide full domain access to a domain controller under a SYSTEM context,” stated Marius Sandbu, guild lead for public cloud at TietoEVRY, in a Wed. writeup. “To be able to use this exploit it requires that you authenticate as a domain user.”
Target Network
Tenable’s Tillis added, “Based on the information available, an attacker with a low-level user account could exploit this vulnerability…& pivot to other areas of the target network. The low-level account could be obtained via an additional vulnerability or even a phishing attack.”
“Without authentication, the flaw could be exploited to elevate privileges, making this vulnerability a valuable link in an attack chain,” Tillis noted.
Does Not Remedy
The team at Sangfor (researchers Zhiniang Peng & Xuefeng Li) said in their GitHub posting (the copied version is here) that in the Domain Controller (DC) environment, the Print Spooler service is normally enabled, so the compromise of any DC user could likely result in RCE.
It should be noted that some sources are also saying that the existing Microsoft patch does not remedy the RCE version. Cube0x0’a impacts implementation works on a fully patched Windows machine, the authors said.
“It should be noted that most endpoints will be safe from this attack with the built-in Windows Firewall default rules,” Sandbu observed.
Coming Soon – More Print Spooler Bugs & Exploits
They also claimed to have found “more hidden bombs” in Print Spooler, which they plan to unveil at Black Hat in Aug.
“Windows Print Spooler has a long history of vulnerabilities & its ubiquity can allow for serious impact on targets,” Tillis noted in the Tenable writeup on Tues. “Most notably, Print Spooler vulnerabilities were tied to the Stuxnet attacks over a decade ago.
More recently, CVE-2020-1337 was a zero-day in print spooler disclosed at last year’s Black Hat & DEF CON events, which happened to be a patch bypass for CVE-2020-1048, another Windows Print Spooler vulnerability that was patched in May 2020.”
https://www.cybernewsgroup.co.uk/virtual-conference-july-2021/
