Microsoft Windows: http.sys use-after-free remote code execution (CVE-2021-31166)

CVE-2021-31166 is a critical use-after-free vulnerability located in the Windows http.sys driver, which handles HTTP requests. Successful exploitation allows an unauthenticated, remote attacker to execute arbitrary code on the target system. The vulnerability was initially patched in May 2021. Recent activity involves the publication of functional proof-of-concept code that utilizes a specifically crafted Accept-Encoding header to trigger the flaw.

Impact

Successful exploitation leads to full system compromise, providing the attacker with the same privileges as the http.sys driver (typically SYSTEM level). This impact is confirmed for unpatched versions of Windows 10 and Windows Server 2004/20H2.

Recommendation

1. Perform an immediate inventory of Windows systems to identify any running instances of the affected Windows 10 or Server versions (2004/20H2) that remain unpatched.
2. Ensure all systems are updated to the security patch level released in May 2021 or later.
3. For internet-facing systems that cannot be patched immediately, deploy the provided WAF block logic to inspect and drop incoming HTTP requests containing the specific Accept-Encoding: doar-e, ftw, imo, , header string.
4. Implement the detection rule below to monitor for malicious header patterns in web server logs.