Full Report
Huntress is aware of PrintNightmare, a critical RCE and local privilege escalation vulnerability. This serious security flaw affects many Windows servers.
Analysis Summary
# Vulnerability: PrintNightmare RCE and LPE
## CVE Details
- **CVE ID:** CVE-2021-34527 (Note: Initially confused with CVE-2021-1675)
- **CVSS Score:** 8.8 (Critical)
- **CWE:** CWE-269 (Improper Privilege Management) / CWE-121 (Stack-based Buffer Overflow)
## Affected Systems
- **Products:** Microsoft Windows and Windows Server
- **Versions:**
- Windows Server 2019, 2016, 2012 R2, 2012, 2008
- Windows 10, 8.1, 7
- *Note: Specific versions like Windows 10 v1607 and Server 2016 initially lacked immediate emergency patches.*
- **Configurations:** Systems running the Print Spooler service (`spoolsv.exe`). Domain Controllers are at particularly high risk.
## Vulnerability Description
PrintNightmare is a critical flaw in the Windows Print Spooler service. It arises from the way the service handles print driver installation via the `RpcAddPrinterDriver` function. An attacker can exploit this by injecting a malicious driver file, allowing for Remote Code Execution (RCE) with SYSTEM privileges or Local Privilege Escalation (LPE). While CVE-2021-1675 was addressed in June 2021, PrintNightmare (CVE-2021-34527) was identified as a distinct, unpatched bypass.
## Exploitation
- **Status:** Exploited in the wild; PoC available (including Mimikatz implementations).
- **Complexity:** Low
- **Attack Vector:** Network (RCE) and Local (LPE)
## Impact
- **Confidentiality:** Total (Full access to system data)
- **Integrity:** Total (Ability to modify system files and configurations)
- **Availability:** Total (Ability to shut down services or crash systems)
## Remediation
### Patches
- Microsoft released emergency Out-of-Band (OOB) updates starting July 6, 2021. Users should apply the latest cumulative updates for their specific Windows version via Windows Update or the Microsoft Update Catalog.
- **Caution:** Early reports suggested patches may not fully mitigate RCE if certain registry keys (`PointAndPrint`) are enabled.
### Workarounds
1. **Disable the Print Spooler service:**
- `Stop-Service -Name Spooler -Force`
- `Set-Service -Name Spooler -StartupType Disabled`
2. **Disable Inbound Remote Printing via Group Policy:**
- Computer Configuration -> Administrative Templates -> Printers -> "Allow Print Spooler to accept client connections" (Set to **Disabled**).
3. **Prune Print Queues:** If the service is disabled, Microsoft recommends pruning print queues to mitigate potential persistence.
## Detection
- **Indicators of Compromise:**
- Monitor for suspicious DLLs being dropped into `C:\Windows\System32\spool\drivers\x64\3\`.
- Unusual child processes spawned by `spoolsv.exe`.
- **Detection Methods:**
- Audit `ImageLoad` events for unsigned or unexpected DLL loads by the Print Spooler.
- Review Event ID 808 (PrintService) for driver installation failures or anomalies.
## References
- [Microsoft Security Advisory - CVE-2021-34527](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527)
- [Huntress Blog: Critical Vuln PrintNightmare](https://www.huntress.com/blog/critical-vulnerability-printnightmare-exposes-windows-servers-to-remote-code-execution)
- [Microsoft MSRC Update Guide](https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1675)