CVE-2024-21325
📋 TL;DR
This vulnerability allows remote code execution through Microsoft's Printer Metadata Troubleshooter Tool. An attacker could exploit this to run arbitrary code with SYSTEM privileges on affected Windows systems. All Windows systems with the vulnerable tool are potentially affected.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with SYSTEM privileges, enabling data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Lateral movement within networks, credential harvesting, and installation of malware payloads.
If Mitigated
Limited impact due to network segmentation, least privilege, and proper patch management.
🎯 Exploit Status
Exploitation requires specific conditions and user interaction or network access to the vulnerable service.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: February 2024 security updates
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21325
Restart Required: Yes
Instructions:
1. Apply the February 2024 Windows security updates. 2. Restart the system. 3. Verify the update is installed via Windows Update history.
🔧 Temporary Workarounds
Disable Printer Troubleshooter Service
windowsDisables the vulnerable Printer Metadata Troubleshooter Tool service.
sc config "PrintWorkflowUserSvc" start= disabled
sc stop "PrintWorkflowUserSvc"
Block Network Access to Print Spooler
windowsRestricts network access to the Print Spooler service to prevent remote exploitation.
netsh advfirewall firewall add rule name="Block Print Spooler" dir=in action=block protocol=TCP localport=135,445,9100
🧯 If You Can't Patch
- Implement network segmentation to isolate systems with the vulnerable tool.
- Apply strict firewall rules to block unnecessary inbound connections to affected systems.
🔍 How to Verify
Check if Vulnerable:
Check if the February 2024 security update is NOT installed via Windows Update history or systeminfo command.Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify the February 2024 security update is installed and the system has been restarted.📡 Detection & Monitoring
Log Indicators:
- Unusual process creation from PrintWorkflowUserSvc or related print services
- Failed authentication attempts to print services
Network Indicators:
- Unexpected network connections to port 135, 445, or 9100 from external sources
- Anomalous SMB or RPC traffic patterns
SIEM Query:
EventID=4688 AND (NewProcessName="*PrintWorkflow*" OR ParentProcessName="*spoolsv*")