Attacker Value
Very High
(5 users assessed)
Exploitability
Very High
(5 users assessed)
User Interaction
Required
Privileges Required
None
Attack Vector
Network
20

CVE-2021-1675

Disclosure Date: June 08, 2021
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Privilege Escalation
Techniques
Validation
Validated

Description

Windows Print Spooler Elevation of Privilege Vulnerability

Add Assessment

5
Ratings
Technical Analysis

Vulnerability

This was originally classified as a Local Priv Escalation, however recent POC code has been released that enabled a domain authenticated user to remotely escalate to SYSTEM on vulnerable services

Exploit Code

There are several functional exploits available on Github after the initial repository was removed by the authors.

Mitigation

Initial testing shows that the patches released are not sufficient to stop this exploit. It has been tested in Server 2016 and Server 2019.

Disable the print spooler can prevent exploitation.

Event logs can be found for both successful and non-successful exploit attempts in some situations.

Sigma rules can be found: https://github.com/SigmaHQ/sigma/pull/1592

2
Ratings
Technical Analysis

Microsoft has just assigned a new CVE to PrintNightmare (CVE-2021-34527) and published a security guide about this vulnerability. This guide contains a summay, exploitability, workarounds and a FAQ:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527

Future patches will be released at that address.

2
Ratings
  • Attacker Value
    Very High
  • Exploitability
    Very High
Technical Analysis

Vulnerability

Can be used as LPE and RCE. Code will run as SYSTEM.

Possible temporary mitigations

Patch for CVE-2021-1675 published on the 08.06.2021 mitigates exploitation if User is not an admin and computer is not a domain controller.

To mitigate lateral movement a GPO can be used to disabled connections to spooler RPC service https://github.com/LaresLLC/CVE-2021-1675

To mitigate LPE and RCE a ACL for the printer driver can be set https://blog.truesec.com/2021/06/30/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available/

Disabling the spooler service is also an theoretical option, but might come at a high operational cost.

1
Ratings
Technical Analysis

Rapid7 researchers have confirmed that a fully patched (as of June 2021) Windows Server 2019 is exploitable with at least one of the public exploits. There’s still a lot of confusion in the community about what exactly is exploitable and why (e.g., permissions requirements), but don’t let the complexity inherent to these researcher conversations convince you NOT to act. Disable the print spooler, quickly. More info: https://www.rapid7.com/blog/post/2021/06/30/cve-2021-1675-printnightmare-patch-does-not-remediate-vulnerability/

CVSS V3 Severity and Metrics
Base Score:
8.8 High
Impact Score:
5.9
Exploitability Score:
2.8
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • Microsoft

Products

  • Windows,
  • Windows Server,
  • Windows 10 Version 1909 for 32-bit Systems,
  • Windows 10 Version 1909 for x64-based Systems,
  • Windows 10 Version 1909 for ARM64-based Systems,
  • Windows 10 Version 21H1 for x64-based Systems,
  • Windows 10 Version 21H1 for ARM64-based Systems,
  • Windows 10 Version 21H1 for 32-bit Systems,
  • Windows 10 Version 2004 for 32-bit Systems,
  • Windows 10 Version 2004 for ARM64-based Systems,
  • Windows 10 Version 2004 for x64-based Systems,
  • Windows Server, version 2004 (Server Core installation),
  • Windows 10 Version 20H2 for x64-based Systems,
  • Windows 10 Version 20H2 for 32-bit Systems,
  • Windows 10 Version 20H2 for ARM64-based Systems,
  • Windows Server, version 20H2 (Server Core Installation)
Technical Analysis