1. Summary
| Vulnerability Name | HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2022-21907) |
|---|---|
| Release Time | January 13, 2022 |
| Component Name | http.sys |
| Affected Versions | Windows 10, 11 Windows Server 2019, 2022, 20H2 See Section 3 Affected Versions for details |
| Vulnerability Type | Remote Code Execution |
| Exploitability | Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None |
| Impact | Severity: CVSS v3 Base Score: 9.8 (Critical) Confidentiality Impact: High Integrity Impact: High Availability Impact: High |
2. About CVE-2022-21907
2.1 Introduction
The Windows HTTP stack (http.sys) is a kernel driver for processing HTTP requests in Windows servers and clients, commonly used in communication between web browsers and web servers and in Internet Information Services (IIS).
2.2 Summary
On January 13, 2022, Sangfor FarSight Labs received a notice about the HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2022-21907). A buffer overflow can occur due to a boundary error in the HTTP Trailer Support feature in the HTTP protocol stack (http.sys). An unauthorized attacker can trigger a buffer overflow by sending specially crafted HTTP packets to a web server utilizing the HTTP Protocol Stack (http.sys) to process packets, thereby executing arbitrary code on the target system or causing a denial of service.
Microsoft describes this vulnerability as “wormable”, meaning that an attack can spread from one vulnerable system to another on a network without human interaction.
Figure 1. Exploits of CVE-2022-21907 detected by Sangfor from August 28 to September 27, 2022
3. Affected Versions
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 1809 for x64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 21H1 for 32-bit Systems
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows 10 Version 21H2 for 32-bit Systems
Windows 10 Version 21H2 for ARM64-based Systems
Windows 10 Version 21H2 for x64-based Systems
Windows 11 for ARM64-based Systems
Windows 11 for x64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows Server 2022
Windows Server 2022 (Server Core installation)
Windows Server, version 20H2 (Server Core Installation)
4. Solutions
4.1 Remediation Solutions
4.1.1 Check the System Patch Installation
Run "systeminfo" in a CMD window and it will display a list of details about the system, including what patches are installed, as shown below.
Check if the patch corresponding to your OS is installed. Patches for affected OS versions can be found in the link below: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21907
If the patch is not installed, proceed to "4.1.2 Microsoft Solution" to download and install the patch.
4.1.2 Microsoft Solution
Microsoft has released a patch for affected OS versions to fix this vulnerability. Please download the patch corresponding to the affected OS from the following link: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21907
4.2 Sangfor Solutions
4.2.1 Security Monitoring
The following Sangfor products and services perform real-time monitoring of assets affected by the HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2022-21907):
- Sangfor Cyber Command (Network Detection and Response)
- Sangfor Cyber Guardian (Managed Detection and Response)
4.2.2 Security Protection
The following Sangfor products and services provide protection against the HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2022-21907):
- Sangfor NGAF (Next Generation Firewall)
5. Timeline
On January 13, 2022, Sangfor FarSight Labs received a notice about the HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2022-21907).
On January 13, 2022, Sangfor FarSight Labs released a vulnerability alert with remediation solutions.
6. Reference
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21907
7. Learn More
Sangfor FarSight Labs researches the latest cyberthreats and unknown zero-day vulnerabilities, alerting customers to potential dangers to their organizations, and providing real-time solutions with actionable intelligence. Sangfor FarSight Labs works with other security vendors and the security community at large to identify and verify global cyberthreats, providing fast and easy protection for customers.
