Code demonstrating how to exploit an 0day vulnerability in the Windows Print Spooler was accidentally published on GitHub this week. This remote code execution vulnerability can be exploited to take control of a fully patched Windows Domain Controller.
In the June 2021 Patch bundle, Microsoft delivered a fix for CVE-2021-1675, an elevation of privilege and remote code execution vulnerability in the Windows Print Spooler service.
Seeing the patch had been released, a security research firm published their proof-of-concept code for the remote execution vulnerability in the spooler service. However, the flaw the researchers had found was similar but not identical to the bug Microsoft had just patched. As a result, they inadvertently published a working code example for a 0day vulnerability in the spooler code. Realising their mistake, the code was removed from GitHub, but not before several copies were taken – assuring the code will find its way to threat actor groups in order to be exploited.
CISA has issued a security alert which advises System Administrators to disable the Windows Print Spooler service on all domain controllers and other systems that do not have printers attached. This can be done through Group Policy settings according to Microsoft’s security guidelines for Domain Controllers.
Disabling the print spooler service on system that do not have printers connected is an example of reducing the attack surface of the server – one of the steps taken when hardening a server against attack.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)