Technical Information

Brief overview of the risk:

Also known as PrintNightmare, is a Remote Code Execution(RCE) vulnerability. This vulnerability is caused when Windows Print Spooler service performs improper privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges.

Technical Details:

Print Spooler is responsible for managing all requests related to printing. Applications use the spooler to queue-up a series of documents and then print them out in the background. By default the print spooler service is enabled on all Windows-based systems, including domain controllers and computers with system admin privileges.

The vulnerability stems from a functionality of the print spooler service through which an user with any low-level privilege can add a new printer remotely. The spooler service makes use of two RPC protocols namely, RpcAsyncAddPrinterDriver() and RpcAddPrinterDriverEx() . These two protocols require multiple parameters including

• pDataFile
• pConfigFile
• pDriverPath

to add the new printer. When adding a new printer, the spooler service checks if the pDataFile’s and pDriverPath’s path is not a UNC(Universal Naming Convention) path. But this check is not done for pConfigFile’s path as a result the file given to pConfigFile is copied to %SYSTEMROOT%\system32\spool\drivers\x64\3\ (on x64 versions of the OS) location.
The logic is written in such a way that if a new printer is added next time giving this file path, it bypasses UNC path check and loads that DLL.
This location is not a valid UNC path so next time when adding a new printer if this file is given as the pDataFile parameter the UNC path check can be bypassed.

This vulnerability can be exploited by an attacker to gain Remote Code Execution on the target machine. CVE-2021-1675 is also similar to this vulnerability but it is a local Elevation of Privilege and requires an authenticated user to exploit the vulnerability.

This vulnerability is seen exploited in the wild, we urge users to patch their systems to the latest update. Here are some recommendations

Recommendations:

• Update your patch for the vulnerability here
• Disable printer spooler service if not needed
• Disable inbound remote printing in your group policy