Connect with us

Hi, what are you looking for?



CISA Warns of Windows Print Spooler Flaw After Microsoft Sees Russian Exploitation

CISA warns organizations of a two-year-old Windows Print Spooler vulnerability being exploited in the wild.

The US cybersecurity agency CISA on Tuesday added a two-year-old Windows Print Spooler flaw to its Known Exploited Vulnerabilities (KEV) catalog.

Tracked as CVE-2022-38028 (CVSS score of 7.8) and addressed as part of Microsoft’s October 2022 Patch Tuesday updates, the issue can be exploited to gain System privileges on a vulnerable machine.

“Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions,” CISA’s entry in the KEV catalog reads.

Per the Binding Operational Directive (BOD) 22-01, federal agencies have three weeks to identify within their environments any system vulnerable to CVE-2022-38028 and apply the available patches or remove the vulnerable products.

Although BOD 22-01 only applies to federal agencies, CISA urges all organizations to perform vulnerability assessments and address the security bugs in the KEV catalog as soon as possible.

CISA added CVE-2022-38028 to its must-patch list one day after Microsoft reported that a Russian cyberespionage group known as APT28 (tracked by the tech giant as Forest Blizzard) has been exploiting it in attacks targeting government, non-governmental, education, and transportation organizations.

As part of the observed attacks, the advanced persistent threat (APT) actor has been deploying a unique tool dubbed GooseEgg that can spawn other applications with System-level permissions, opening the door to remote code execution, backdoor deployment, and lateral movement.

According to Microsoft, APT28 was also observed exploiting other Print Spooler vulnerabilities for GooseEgg deployment, including CVE-2023-23397 and the PrintNightmare bugs tracked as CVE-2021-34527 and CVE-2021-1675.

Advertisement. Scroll to continue reading.

In the case of CVE-2022-38028, there were no reports of in-the-wild exploitation before Microsoft published its blog post on the GooseEgg attacks.

The main purpose of these attacks, the tech giant says, has been privilege escalation and credential and data harvesting.

Related: CISA: Second SharePoint Flaw Disclosed at Pwn2Own Exploited in Attacks

Related: Faster Patching Pace Validates CISA’s KEV Catalog Initiative

Related: CISA Warns of Windows Streaming Service Vulnerability Exploitation

Written By

Ionut Arghire is an international correspondent for SecurityWeek.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how to utilize tools, controls, and design models needed to properly secure cloud environments.


Event: ICS Cybersecurity Conference

The leading industrial cybersecurity conference for Operations, Control Systems and IT/OT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.


People on the Move

Check Point Software has appointed Nadav Zafrir as Chief Executive Officer

BlackFog has named Brenda Robb as President, John Sarantakes as CRO, and Mark Griffith as VP of Strategic Sales

Former NSA cybersecurity chief Rob Joyce has joined Sandfly Security's Advisory Board.

More People On The Move

Expert Insights