Exploit released for wormable Windows HTTP vulnerability

Proof-of-concept exploit code has been released over the weekend for a critical wormable vulnerability in the latest Windows 10 and Windows Server versions.

The bug, tracked as CVE-2021-31166, was found in the HTTP Protocol Stack (HTTP.sys) used by the Windows Internet Information Services (IIS) web server as a protocol listener for processing HTTP requests.

Microsoft has patched the vulnerability during this month's Patch Tuesday, and it impacts ONLY Windows 10 versions 2004/20H2 and Windows Server versions 2004/20H2.

CVE-2021-31166 exploits require attackers to send maliciously crafted packets to targeted servers utilizing the vulnerable HTTP Protocol Stack to process packets.

Microsoft recommends prioritizing patching all affected servers since the bug could allow unauthenticated attackers to execute arbitrary code remotely "in most situations."

Demo exploit triggers blue screens of death

The demo exploit code released by security researcher Axel Souchet on Sunday is a proof-of-concept (PoC) that lacks auto-spreading capabilities.

His PoC exploit abuses a use-after-free dereference in HTTP.sys to trigger a denial of service (DoS), leading to a blue screen of death BSOD on vulnerable systems.

"The bug itself happens in http!UlpParseContentCoding where the function has a local LIST_ENTRY and appends item to it," Souchet explains.

"When it's done, it moves it into the Request structure; but it doesn't NULL out the local list.

"The issue with that is that an attacker can trigger a code-path that frees every entries of the local list leaving them dangling in the Request object."

I've built a PoC for CVE-2021-31166 the "HTTP Protocol Stack Remote Code Execution Vulnerability": https://t.co/8mqLCByvCp pic.twitter.com/yzgUs2CQO5

Most potential targets likely safe from attacks

While the PoC's release could allow threat actors to develop their own faster, potentially allowing remote code execution, the patching process should also be fast and the impact limited given that most home users with the latest Windows 10 versions should have already updated earlier this week.

Likewise, most companies are likely safe from exploits targeting the CVE-2021-31166 bug since they don't commonly use the latest Window Server versions.

Microsoft has patched other wormable bugs in the last two years, impacting the Remote Desktop Services (RDS) platform (aka BlueKeep), the Server Message Block v3 protocol (aka SMBGhost), and the Windows DNS Server (aka SIGRed).

Attackers are yet to abuse them to create wormable malware capable of spreading between computers running these vulnerable Windows components.