CVE-2020-1337
📋 TL;DR
CVE-2020-1337 is a local privilege escalation vulnerability in the Windows Print Spooler service that allows authenticated attackers to write arbitrary files to the system. This enables execution of arbitrary code with SYSTEM privileges. Affected systems include various Windows versions with the Print Spooler service enabled.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 7 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains full SYSTEM privileges, can install malware, create backdoor accounts, exfiltrate sensitive data, and achieve complete system compromise.
Likely Case
Local authenticated attacker elevates privileges to SYSTEM, installs persistence mechanisms, and accesses sensitive system resources.
If Mitigated
With proper access controls and monitoring, impact limited to isolated systems with quick detection and containment.
🎯 Exploit Status
Multiple public exploit scripts available; requires local authenticated access to target system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: August 2020 security updates (KB4566782, KB4565351, etc.)
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337
Restart Required: Yes
Instructions:
1. Apply August 2020 Windows security updates from Windows Update. 2. Restart system. 3. Verify Print Spooler service is updated.
🔧 Temporary Workarounds
Disable Print Spooler Service
windowsStops the vulnerable service but disables printing functionality
sc stop spooler
sc config spooler start= disabled
Restrict Spooler Directory Permissions
windowsLimit write access to spooler directories
icacls C:\Windows\System32\spool\PRINTERS /deny "Authenticated Users":(OI)(CI)F
🧯 If You Can't Patch
- Disable Print Spooler service on non-printing servers
- Implement strict access controls and monitor for suspicious spooler activity
🔍 How to Verify
Check if Vulnerable:
Check if August 2020 security updates are installed via 'wmic qfe list' or 'systeminfo'Check Version:
wmic qfe list | findstr KB4566782Verify Fix Applied:
Verify Print Spooler service version and check that August 2020 updates are applied📡 Detection & Monitoring
Log Indicators:
- Event ID 7036 for Print Spooler service stops/starts
- Suspicious file writes to spool directories
- Unexpected privilege escalation events
Network Indicators:
- Local authentication followed by spooler service manipulation
SIEM Query:
EventID=7036 AND ServiceName="Spooler" AND (State="stopped" OR State="started")🔗 References
- http://packetstormsecurity.com/files/160028/Microsoft-Windows-Local-Spooler-Bypass.html
- http://packetstormsecurity.com/files/160993/Microsoft-Spooler-Local-Privilege-Elevation.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337
- http://packetstormsecurity.com/files/160028/Microsoft-Windows-Local-Spooler-Bypass.html
- http://packetstormsecurity.com/files/160993/Microsoft-Spooler-Local-Privilege-Elevation.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1337
