Microsoft released a security update to fix the latest PrintNightmare zero-day vulnerabilities that allowed attackers to quickly gain administrative privileges on Windows devices.
In June, a Windows zero-day print spooler vulnerability dubbed PrintNightmare (CVE-2021-34527) was accidentally revealed. The vulnerability exploits the Point and Print feature of Windows to execute remote code and gain local SYSTEM privileges.
While Microsoft released two security updates to fix various vulnerabilities in PrintNightmare, another vulnerability publicly disclosed by a security researcher Benjamin Delpy still allowed malicious actors to quickly gain SYSTEM privileges by simply connecting to a remote print server.
As demonstrated below, the Delpy vulnerability abused the CopyFiles directive to copy and run malicious DLLs using SYSTEM privileges when a user installed a remote printer. Once the exploit launched the DLL, it would open a console window where all commands are executed with SYSTEM privileges.
To make matters worse, ransomware gangs, such as Vice Society, Magniber, and Conti, started using the bug to gain elevated privileges on compromised devices.
This remaining PrintNightmare vulnerability is tracked as CVE-2021-36958 and is attributed to Victor mata from FusionX, Accenture Security, which privately disclosed the bug to Microsoft in December 2020.
New security update fixes PrintNightmare bug
In the September 2021 Patch Tuesday security updates, Microsoft released a new security update for CVE-2021-36958 that fixes the remaining PrintNightmare vulnerability.
Delpy, who tested his exploit against the new security update, confirmed to TechToSee that the bug is now fixed.
– Benjamin Delpy (@gentilkiwi) September 14, 2021
In addition to fixing the vulnerability, Delpy told TechToSee that Microsoft has disabled the CopyFiles feature by default and added an undocumented Group Policy that allows administrators to re-enable it.
This policy can be configured in the Windows registry under HKLM Software Policies Microsoft Windows NT Printers key and adding a named value CopyFilesPolicy. When set to “1”, CopyFiles will be enabled again.
However, even when enabled, Delpy told TechToSee that he would only allow Microsoft C: Windows System32 mscms.dll file to use with this feature.
As this change will affect the default Windows behavior, it is not known what issues this will cause when printing in Windows.
Microsoft has not released any information about this new Group Policy at this time and it is not available in the Group Policy Editor.
In addition to the PrintNightmare vulnerability, today’s updates also address an actively exploited Windows MSHTML zero-day vulnerability.
As both of these vulnerabilities are known to be exploited by threat actors during attacks, it is critical to install today’s Patch Tuesday security updates as soon as possible.