In an advisory released by Microsoft on July 15th 2021 via their website, a new vulnerability related to Print Spooler service has been disclosed. This vulnerability is a Local Privilege Escalation (LPE) vulnerability. This vulnerability can only be exploited locally, with a valid domain-joined account to gain elevated privileges on a vulnerable device, however, Dataprise still considers this a HIGH severity incident because an attacker using a compromised domain account could use this vulnerability to elevate their privileges. Microsoft is currently investigating this vulnerability and a security update is yet to be released. The US CERT/CC has advised, and Microsoft concurs, that organizations should disable the Print Spooler service on Domain Controllers and any other servers that are not being used for printing. This mitigation works to prevent the exploitation of this new Print Spooler vulnerability as well as the two recent vulnerabilities in the Print Spooler, collectively called PrintNightmare.
This local privilege escalation vulnerability, CVE-2021-34481, exists in the Windows Print Spooler service when it improperly performs privileged file operations. An attacker who successfully exploits this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
An attacker must have the ability to execute code on a victim system to exploit this vulnerability.
The workaround for this vulnerability is stopping and disabling the Print Spooler service.
- Determine if the print Spooler service is running
Run the following in windows PowerShell : Get-Service -Name Spooler
If the Print Spooler is running or if the service is not disabled, please stop and disable the Print Spooler service.
- Stop and Disable the Print Spooler Service
Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled
- Stephen Jones, Senior Director Cybersecurity
- Ayyappa Vyamasani, Security Analyst