|
|
|
This alert from Novacoast is intended to brief users and administrators on newly discovered threats, vulnerabilities, and critical software updates. |
|
|
Critical PrintNightmare RCE Vulnerability Exploitable in Fully Patched SystemsCVE-2021-1675 remains exploitable as privilege escalation and remote code execution after June Tuesday Patch
BackgroundOn June 8, 2021, Microsoft released their June Tuesday Patch that included a patch for the CVE-2021-1675 (now being referred to as “PrintNightmare”) critical vulnerability in the Windows Print Spooler service. Originally, the vulnerability was classified as a privilege escalation vulnerability, but on June 20, 2021, the severity was updated from low to critical (discovery credited to Zhipeng Huo of Tencent Security Xuanwu Lab, Piotr Madej of AFINE and Yunhai Zhang of NSFOCUS TIANJI Lab) with potential for remote code execution (RCE). Currently, multiple copies of proof-of-concept code have been released for remote code execution that were found to render the June Tuesday Patch ineffective against these exploits. For details about the Windows Printer Spooler service, please see Microsoft's official article.
What is the nature of the vulnerability?Nicknamed “PrintNightmare,” the vulnerability can allow an authenticated user to execute arbitrary code with SYSTEM privileges that targets Active Directory domain controllers. CVE-2021-1675 was originally identified as only operating as a Privilege Escalation vulnerability, until the released exploit code revealed additional issues. According to Rapid7, "all domain controllers, even those that are fully patched, are vulnerable to remote code execution by authenticated attackers." If the attacker is not authenticated, the vulnerability can still be used to escalate privilege, which could then be used in an attack chain.
MitigationsThere are no official practical mitigations for this vulnerability yet. Recommendations from CERT and Microsoft, among others, include disabling the Windows Printer Spooler service in Domain Controllers and other systems that do not print. Microsoft's how-to guides suggest that, "the best way to do this is using a Group Policy Object." Disabling the Print Spooler service may result in unintended loss of functionality, specifically the loss of print pruning on Domain Controllers. It is recommended to periodiocally manually prune stale print queue objects if the Print Spooler service is disabled. Disable Spooler Service via Windows Command-Line (3 Options):
Uninstall Print-Services:
With PowerShell (2 Options):
DetectionsOther than disabling the service, monitoring rules can be utilized. Sigma rules on GitHub are available that look for anything being written to or executed/loaded from subfolders of C:/Windows/System32/spool/drivers/x64/3. We have found that some environments use this folder, as well as the subfolders of /new/ and /old/, legitimately, so we advise validating any DLLs that are in the 3 folder or below by hash. The following PowerShell command may also be used to help find exploitation attempts:
Still have questions?Call the Novacoast SOC at (866) 863-9575 to speak with our briefed technicians who can advise and assist you.
ResourcesCybersecurity & Infrastructure Security Agency's article Microsoft's documentation on Printer Spooler security assessments Carnegie Mellon University's article Rapid7's Blog article GitHub resource on PrintNightmare Sigma's rule logic on GitHub Novacoast's security advisory on the June Tuesday Patch DW/EM |
- Novacoast Inc 1505 Chapala St. Santa Barbara CA 93101 United States of America
- View web version | Unsubscribe