The US cybersecurity agency CISA on Tuesday added a two-year-old Windows Print Spooler flaw to its Known Exploited Vulnerabilities (KEV) catalog.
Tracked as CVE-2022-38028 (CVSS score of 7.8) and addressed as part of Microsoft’s October 2022 Patch Tuesday updates, the issue can be exploited to gain System privileges on a vulnerable machine.
“Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions,” CISA’s entry in the KEV catalog reads.
Per the Binding Operational Directive (BOD) 22-01, federal agencies have three weeks to identify within their environments any system vulnerable to CVE-2022-38028 and apply the available patches or remove the vulnerable products.
Although BOD 22-01 only applies to federal agencies, CISA urges all organizations to perform vulnerability assessments and address the security bugs in the KEV catalog as soon as possible.
CISA added CVE-2022-38028 to its must-patch list one day after Microsoft reported that a Russian cyberespionage group known as APT28 (tracked by the tech giant as Forest Blizzard) has been exploiting it in attacks targeting government, non-governmental, education, and transportation organizations.
As part of the observed attacks, the advanced persistent threat (APT) actor has been deploying a unique tool dubbed GooseEgg that can spawn other applications with System-level permissions, opening the door to remote code execution, backdoor deployment, and lateral movement.
According to Microsoft, APT28 was also observed exploiting other Print Spooler vulnerabilities for GooseEgg deployment, including CVE-2023-23397 and the PrintNightmare bugs tracked as CVE-2021-34527 and CVE-2021-1675.
In the case of CVE-2022-38028, there were no reports of in-the-wild exploitation before Microsoft published its blog post on the GooseEgg attacks.
The main purpose of these attacks, the tech giant says, has been privilege escalation and credential and data harvesting.
Related: CISA: Second SharePoint Flaw Disclosed at Pwn2Own Exploited in Attacks
Related: Faster Patching Pace Validates CISA’s KEV Catalog Initiative
Related: CISA Warns of Windows Streaming Service Vulnerability Exploitation
