Worming your way in through IIS - CVE-2022-21907

2022-01-2700:00:00

www.trellix.com

JSON

Worming your way in through IIS -

CVE-2022-21907

By Trellix · January 27, 2022

This story was written by Eion Carroll.

IIS HTTP Stack History

In the first patch Tuesday of 2022, Microsoft released a patch for a wormable vulnerability CVE-2022-21907 within the IIS HTTP stack, or more specifically the HTTP.sys driver. This is the second such vulnerability in the Microsoft HTTP.sys driver within the last 7 months, both with a critical CVSS score of 9.8. As always, our objective for critical industry vulnerability analysis is to protect our customers and the broader community of internet connected users by using qualitative and experience-based analysis. While the security industry is still recovering from the aftermath of “Log4j” CVE-2021-44228, we cannot lose sight of other critical vulnerabilities with wormability characteristics.

CVE-2021-31166 which we analyzed 7 months ago, was also wormable but did not see much weaponization. This may be in part because enterprises are now reducing their exposure window by patching sooner, as a result of former vulnerabilities, including the infamous Eternalblue, as well as the active research by threat research teams to flag critical vulnerabilities which must be patched.

CVE-2022-21907 Vulnerability Analysis and Attack Scenario

From our patch analysis the CVE-2022-21907 is an uninitialized memory vulnerability within two memory allocation functions called UlpAlllocateFactTracker and UlAllocateFastTrackerToLookaside. These functions fail to zero allocated memory in the kernel non-paged pool before performing later operations. By grooming the kernel non-paged pool remotely it’s possible to place the pool memory into a state so that the uninitialized memory allocated by UlpAlllocateFactTracker and UlAllocateFastTrackerToLookaside is populated with attacker-controlled data. Grooming is achieved by sending very large http header fields with attacker-controlled data, which results in allocation in the kernel non paged pool. From our analysis it takes several minutes to groom the kernel non-paged pool to crash a system, but this time is completely dependent on a server’s existing kernel pool memory state. Successful exploitation would require remotely creating read, write, and execute primitives which is no easy task. However, the vulnerability has the properties to achieve remote code execution and denial-of-service (Blue Screen of Death) for affected versions of Windows. Being able to remotely crash IIS without requiring authentication would of course be enticing for attackers.

Mitigations

Microsoft clearly state in the advisory which Windows OS versions are impacted; however, there has been much discussion in the industry regarding which versions are impacted. Therefore, we recommend patching all IIS servers, focusing on externally facing IIS servers as a top priority. For those who are unable to apply Microsoft’s update, we are providing a “virtual patch” in the form of a network IPS signature that can be used to detect and prevent exploitation attempts for this vulnerability. If you cannot patch or protect by using our network IPS signature, then we recommend detecting at the network level for HTTP header fields with very large data being sent in many consecutive HTTP requests, which would indicate remote grooming. Web Servers generally only check the sum of all HTTP header fields data and not the individual fields data length.

At the time of this writing, we are unaware of any “in-the-wild” exploitation for CVE-2022-21907 but will continue to monitor the threat landscape and provide relevant updates. We are starting to see a trend of HTTP.sys vulnerabilities and urge enterprises to be prepared for potential further prioritized patching.

PATCH NOW if you are using IIS!