Worming your way in through IIS -
By Trellix · January 27, 2022
This story was written by Eion Carroll.
IIS HTTP Stack History
In the first patch Tuesday of 2022, Microsoft released a patch for a wormable vulnerability CVE-2022-21907 within the IIS HTTP stack, or more specifically the HTTP.sys driver. This is the second such vulnerability in the Microsoft HTTP.sys driver within the last 7 months, both with a critical CVSS score of 9.8. As always, our objective for critical industry vulnerability analysis is to protect our customers and the broader community of internet connected users by using qualitative and experience-based analysis. While the security industry is still recovering from the aftermath of “Log4j” CVE-2021-44228, we cannot lose sight of other critical vulnerabilities with wormability characteristics.
CVE-2021-31166 which we analyzed 7 months ago, was also wormable but did not see much weaponization. This may be in part because enterprises are now reducing their exposure window by patching sooner, as a result of former vulnerabilities, including the infamous Eternalblue, as well as the active research by threat research teams to flag critical vulnerabilities which must be patched.
CVE-2022-21907 Vulnerability Analysis and Attack Scenario
From our patch analysis the CVE-2022-21907 is an uninitialized memory vulnerability within two memory allocation functions called UlpAlllocateFactTracker and UlAllocateFastTrackerToLookaside. These functions fail to zero allocated memory in the kernel non-paged pool before performing later operations. By grooming the kernel non-paged pool remotely it’s possible to place the pool memory into a state so that the uninitialized memory allocated by UlpAlllocateFactTracker and UlAllocateFastTrackerToLookaside is populated with attacker-controlled data. Grooming is achieved by sending very large http header fields with attacker-controlled data, which results in allocation in the kernel non paged pool. From our analysis it takes several minutes to groom the kernel non-paged pool to crash a system, but this time is completely dependent on a server’s existing kernel pool memory state. Successful exploitation would require remotely creating read, write, and execute primitives which is no easy task. However, the vulnerability has the properties to achieve remote code execution and denial-of-service (Blue Screen of Death) for affected versions of Windows. Being able to remotely crash IIS without requiring authentication would of course be enticing for attackers.
Microsoft clearly state in the advisory which Windows OS versions are impacted; however, there has been much discussion in the industry regarding which versions are impacted. Therefore, we recommend patching all IIS servers, focusing on externally facing IIS servers as a top priority. For those who are unable to apply Microsoft’s update, we are providing a “virtual patch” in the form of a network IPS signature that can be used to detect and prevent exploitation attempts for this vulnerability. If you cannot patch or protect by using our network IPS signature, then we recommend detecting at the network level for HTTP header fields with very large data being sent in many consecutive HTTP requests, which would indicate remote grooming. Web Servers generally only check the sum of all HTTP header fields data and not the individual fields data length.
At the time of this writing, we are unaware of any “in-the-wild” exploitation for CVE-2022-21907 but will continue to monitor the threat landscape and provide relevant updates. We are starting to see a trend of HTTP.sys vulnerabilities and urge enterprises to be prepared for potential further prioritized patching.
PATCH NOW if you are using IIS!
McAfee Network Security Platform (NSP) Protection
Component attack: 0x452a1500 “HTTP: Long Request Header Detected”
Correlation attack: 0x452a1300 "HTTP: Microsoft IIS Protocol Stack Remote Code Execution Vulnerability (CVE-2022-21907)”
McAfee Knowledge Base Article KB95180
May 30, 2023
Trellix Expands AWS Integrations to Provide Greater Data Security to Cloud Infrastructure Customers
May 8, 2023
CRN Recognizes Trellix on its 2023 Women of the Channel and Power 100 Lists
Apr 25, 2023
96% of CISOs Struggle to Get the Support Required to Be Resilient Against Cyber Attacks
Apr 24, 2023
Trellix Launches Comprehensive Endpoint Security Suite
Apr 24, 2023
Trellix Receives FedRAMP High Authorization to Operate for Trellix Extended Detection and Response GovCloud
The latest from our newsroom
The Bug Report – May 2023 Edition
By Mark Bereza · June 7, 2023
April showers bring May flowers, but what do May flowers bring? CVE-2023-28771, CVE-2023-2868, and CVE-2023-24932, apparently.
Normalize Your Environment
By Kyle Wood · June 2, 2023
This blog focuses on the key areas needed to gain a clear and clean view into your environment to more easily identify malicious activity.
Working Together to Invest in People
By Michael Alicea · May 17, 2023
I was honored to participate in a recent RSAC cyber skills panel discussing how the public, private, and non-profit sectors can work together to support the successful implementation of the National Cyber Workforce Strategy.
Get the latest
We’re no strangers to cybersecurity. But we are a new company.
Stay up to date as we evolve.
Zero spam. Unsubscribe at any time.