CVE-2021-31166
Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability
Description
CVE-2021-31166 is a wormable remote code execution vulnerability in the Microsoft HTTP Protocol Stack (HTTP.sys) that allows unauthenticated attackers to execute arbitrary code on affected Windows systems by sending specially crafted HTTP packets. The "wormable" designation means the vulnerability could be exploited to spread automatically between vulnerable systems without user interaction. It was added to CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. With an EPSS score of 96.3% (99.8th percentile), this vulnerability represents an extremely high exploitation risk.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 2004 | < 10.0.19041.982 |
| microsoft | windows 10 20h2 | < 10.0.19042.982 |
| microsoft | windows server 2004 | < 10.0.19041.982 |
| microsoft | windows server 20h2 | < 10.0.19042.982 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/162722/Microsoft-HTTP-Protocol-Stack-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31166(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-31166(US Government Resource)
Weakness Type
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
This weakness involves performing operations on a memory buffer without properly ensuring that read and write actions stay within the buffer's boundaries, potentially leading to memory corruption and code execution. In CVE-2021-31166, HTTP.sys improperly handles certain HTTP requests, causing a use-after-free condition that can be triggered remotely. For more details, see CWE-119.
Impact Analysis
The wormable nature of this vulnerability makes it exceptionally dangerous from a business perspective. A single successful exploitation could cascade across an entire network of vulnerable Windows servers without any user interaction, similar to the devastating WannaCry and NotPetya incidents. Affected systems include any Windows 10 or Windows Server system running the HTTP.sys driver, which is used by IIS and various Windows services. Successful exploitation leads to remote code execution at the kernel level, granting attackers complete control over affected systems. The potential for automated propagation means that an organization's entire Windows server infrastructure could be compromised in minutes.
Exploit Maturity
CVE-2021-31166 was added to CISA's KEV catalog on April 6, 2022, confirming active exploitation. The EPSS score of 96.3% (99.8th percentile) indicates extremely high exploitation activity. Proof-of-concept exploits demonstrating both denial of service and remote code execution capabilities have been publicly released. While widespread worm-like propagation has not been observed at scale, the technical capability exists, and active exploitation by targeted threat actors has been confirmed.
Remediation
- Apply the Microsoft security update from May 2021 (KB5003173 or applicable cumulative update) immediately, as required by CISA's KEV catalog.
- Verify that all Windows Server systems running IIS or other HTTP.sys-dependent services are patched by checking the installed update history.
- Implement network segmentation to limit lateral movement in case of exploitation, particularly isolating internet-facing web servers.
- Deploy intrusion detection/prevention systems (IDS/IPS) with signatures for CVE-2021-31166 exploitation attempts.
- Monitor network traffic for unusual HTTP patterns and unexpected connections between internal servers that could indicate worm-like propagation attempts.
Technical Details
The vulnerability exists in HTTP.sys, the kernel-mode driver that handles HTTP requests in Windows. When processing certain types of HTTP requests with specific header combinations, HTTP.sys triggers a use-after-free condition in its internal request handling logic. The driver incorrectly frees a memory object that is subsequently referenced, allowing an attacker to control the contents of the freed memory through heap manipulation techniques. Because HTTP.sys operates in kernel mode, successful exploitation results in kernel-level code execution, providing the attacker with the highest level of system privileges. The attack can be performed by sending a single specially crafted HTTP request to any service using HTTP.sys, requiring no authentication.
Frequently Asked Questions
What is CVE-2021-31166?
CVE-2021-31166 is a wormable remote code execution vulnerability in Microsoft's HTTP Protocol Stack (HTTP.sys). It allows unauthenticated attackers to execute code at the kernel level by sending crafted HTTP packets, and can theoretically propagate automatically between vulnerable systems.
What does "wormable" mean for this vulnerability?
Wormable means the vulnerability could be exploited to create a self-propagating attack that spreads automatically from one vulnerable system to another without any user interaction. This is similar to vulnerabilities exploited by EternalBlue (WannaCry/NotPetya), though large-scale worm propagation has not been observed for this specific CVE.
Which Windows versions are affected?
The vulnerability affects Windows 10 version 2004 and later, as well as Windows Server 2004 and later versions that include the vulnerable HTTP.sys driver. Older Windows versions that do not include the affected HTTP.sys changes are not vulnerable.
Is my system at risk if it doesn't run IIS?
Potentially yes. While IIS is the most common service using HTTP.sys, other Windows services and applications may also use this kernel driver to handle HTTP traffic. Any system with the affected Windows version that has HTTP.sys active could be vulnerable, even without IIS installed.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.