CVE-2021-28321
📋 TL;DR
CVE-2021-28321 is an elevation of privilege vulnerability in Microsoft's Diagnostics Hub Standard Collector Service. It allows authenticated attackers to execute arbitrary code with SYSTEM privileges by exploiting improper symbolic link handling. This affects Windows systems with the vulnerable service installed.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Visual Studio by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, enabling installation of malware, data theft, lateral movement, and persistence mechanisms.
Likely Case
Privilege escalation from a standard user account to SYSTEM, allowing attackers to bypass security controls and install additional payloads.
If Mitigated
Limited impact if proper access controls, least privilege principles, and network segmentation are implemented.
🎯 Exploit Status
Exploit code is publicly available and relatively simple to execute. Requires authenticated user access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: April 2021 security updates (KB5001330 for Windows 10 20H2, KB5001337 for Windows 10 2004, etc.)
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28321
Restart Required: Yes
Instructions:
1. Apply April 2021 Windows security updates via Windows Update. 2. For enterprise environments, deploy updates through WSUS or SCCM. 3. Restart systems after patch installation.
🔧 Temporary Workarounds
Disable Diagnostics Hub Service
windowsDisable the vulnerable Diagnostics Hub Standard Collector Service to prevent exploitation.
sc config diagsvc start= disabled
sc stop diagsvc
Remove Service Permissions
windowsModify service permissions to restrict access to the Diagnostics Hub service.
sc sdset diagsvc D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
🧯 If You Can't Patch
- Disable the Diagnostics Hub Standard Collector Service using administrative tools
- Implement strict access controls and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check if Diagnostics Hub Service (diagsvc) is running and Windows version is affected: sc query diagsvc and winverCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify April 2021 security updates are installed: wmic qfe list | findstr KB5001330 (or relevant KB)📡 Detection & Monitoring
Log Indicators:
- Event ID 4688 with process creation from diaghost.exe with unusual parent processes
- Service control manager events for diagsvc service
Network Indicators:
- Unusual outbound connections from systems after privilege escalation
SIEM Query:
EventID=4688 AND (NewProcessName="*diaghost.exe" OR ParentProcessName="*diaghost.exe")🔗 References
- http://packetstormsecurity.com/files/162251/Microsoft-DiagHub-Privilege-Escalation.html
- http://seclists.org/fulldisclosure/2021/Apr/40
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28321
- http://packetstormsecurity.com/files/162251/Microsoft-DiagHub-Privilege-Escalation.html
- http://seclists.org/fulldisclosure/2021/Apr/40
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-28321
