Microsoft Print Spooler LPE Vulnerability: Dataprise Defense Digest

Executive Summary

In an advisory released by Microsoft on July 15th 2021 via their website, a new vulnerability related to Print Spooler service has been disclosed. This vulnerability is a Local Privilege Escalation (LPE) vulnerability. This vulnerability can only be exploited locally, with a valid domain-joined account to gain elevated privileges on a vulnerable device, however, Dataprise still considers this a HIGH severity incident because an attacker using a compromised domain account could use this vulnerability to elevate their privileges. Microsoft is currently investigating this vulnerability and a security update is yet to be released. The US CERT/CC has advised, and Microsoft concurs, that organizations should disable the Print Spooler service on Domain Controllers and any other servers that are not being used for printing. This mitigation works to prevent the exploitation of this new Print Spooler vulnerability as well as the two recent vulnerabilities in the Print Spooler, collectively called PrintNightmare.

Detailed Analysis

This local privilege escalation vulnerability, CVE-2021-34481, exists in the Windows Print Spooler service when it improperly performs privileged file operations. An attacker who successfully exploits this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

An attacker must have the ability to execute code on a victim system to exploit this vulnerability.

The workaround for this vulnerability is stopping and disabling the Print Spooler service.

Mitigation Steps

1. Determine if the print Spooler service is running

Run the following in windows PowerShell : Get-Service -Name Spooler

If the Print Spooler is running or if the service is not disabled, please stop and disable the Print Spooler service.

2. Stop and Disable the Print Spooler Service

Stop-Service -Name Spooler -Force

Set-Service -Name Spooler -StartupType Disabled

Sources

• https://threatpost.com/microsoft-unpatched-bug-windows-print-spooler/167855/
• https://www.bleepingcomputer.com/news/microsoft/microsoft-shares-guidance-on-new-windows-print-spooler-vulnerability/
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34481

Contributing Authors

• Stephen Jones, Senior Director Cybersecurity
• Ayyappa Vyamasani, Security Analyst