Worming your way in through IIS -
CVE-2022-21907
By Trellix · January 27, 2022
This story was written by Eion Carroll.
IIS HTTP Stack History
In the first patch Tuesday of 2022, Microsoft released a patch for a wormable vulnerability CVE-2022-21907 within the IIS HTTP stack, or more specifically the HTTP.sys driver. This is the second such vulnerability in the Microsoft HTTP.sys driver within the last 7 months, both with a critical CVSS score of 9.8. As always, our objective for critical industry vulnerability analysis is to protect our customers and the broader community of internet connected users by using qualitative and experience-based analysis. While the security industry is still recovering from the aftermath of “Log4j” CVE-2021-44228, we cannot lose sight of other critical vulnerabilities with wormability characteristics.
CVE-2021-31166 which we analyzed 7 months ago, was also wormable but did not see much weaponization. This may be in part because enterprises are now reducing their exposure window by patching sooner, as a result of former vulnerabilities, including the infamous Eternalblue, as well as the active research by threat research teams to flag critical vulnerabilities which must be patched.
CVE-2022-21907 Vulnerability Analysis and Attack Scenario
From our patch analysis the CVE-2022-21907 is an uninitialized memory vulnerability within two memory allocation functions called UlpAlllocateFactTracker and UlAllocateFastTrackerToLookaside. These functions fail to zero allocated memory in the kernel non-paged pool before performing later operations. By grooming the kernel non-paged pool remotely it’s possible to place the pool memory into a state so that the uninitialized memory allocated by UlpAlllocateFactTracker and UlAllocateFastTrackerToLookaside is populated with attacker-controlled data. Grooming is achieved by sending very large http header fields with attacker-controlled data, which results in allocation in the kernel non paged pool. From our analysis it takes several minutes to groom the kernel non-paged pool to crash a system, but this time is completely dependent on a server’s existing kernel pool memory state. Successful exploitation would require remotely creating read, write, and execute primitives which is no easy task. However, the vulnerability has the properties to achieve remote code execution and denial-of-service (Blue Screen of Death) for affected versions of Windows. Being able to remotely crash IIS without requiring authentication would of course be enticing for attackers.
Mitigations
Microsoft clearly state in the advisory which Windows OS versions are impacted; however, there has been much discussion in the industry regarding which versions are impacted. Therefore, we recommend patching all IIS servers, focusing on externally facing IIS servers as a top priority. For those who are unable to apply Microsoft’s update, we are providing a “virtual patch” in the form of a network IPS signature that can be used to detect and prevent exploitation attempts for this vulnerability. If you cannot patch or protect by using our network IPS signature, then we recommend detecting at the network level for HTTP header fields with very large data being sent in many consecutive HTTP requests, which would indicate remote grooming. Web Servers generally only check the sum of all HTTP header fields data and not the individual fields data length.
At the time of this writing, we are unaware of any “in-the-wild” exploitation for CVE-2022-21907 but will continue to monitor the threat landscape and provide relevant updates. We are starting to see a trend of HTTP.sys vulnerabilities and urge enterprises to be prepared for potential further prioritized patching.
PATCH NOW if you are using IIS!
McAfee Network Security Platform (NSP) Protection
Component attack: 0x452a1500 “HTTP: Long Request Header Detected”
Correlation attack: 0x452a1300 "HTTP: Microsoft IIS Protocol Stack Remote Code Execution Vulnerability (CVE-2022-21907)”
McAfee Knowledge Base Article KB95180
RECENT NEWS
-
Oct 3, 2024
Trellix CEO Rallies the Industry to Support CISO Role
-
Sep 10, 2024
Trellix Integrates Email Security with Data Loss Prevention
-
Aug 21, 2024
U.S. Department of Defense Chooses Trellix to Protect Millions of Email Systems from Zero-Day Threats
-
Aug 14, 2024
Magenta Buyer LLC Raises $400 Million of New Capital
-
Aug 1, 2024
Trellix Endpoint Security Stops 100% of Threats in Leading Industry Test
RECENT STORIES
The latest from our newsroom
Get the latest
We’re no strangers to cybersecurity. But we are a new company.
Stay up to date as we evolve.
Zero spam. Unsubscribe at any time.