CVE-2022-21907

What it actually does

CVE-2022-21907 is a remote code execution vulnerability in the Windows HTTP Protocol Stack, HTTP.sys, the kernel-mode component that processes HTTP traffic for services such as IIS and other Windows components that use HTTP.sys. A remote, unauthenticated attacker can send a specially crafted HTTP request to a vulnerable system and trigger memory corruption during HTTP request processing. Because the vulnerable code runs in the operating system HTTP stack rather than in an individual web application, exploitation can affect any exposed service relying on HTTP.sys. Successful exploitation can allow arbitrary code execution with high privileges, potentially leading to full system compromise. The CVSS score is 9.8 and the EPSS score is very high at 0.9279, with public exploit availability reported, making exposed unpatched systems high-risk even though the vulnerability is not currently listed in CISA KEV.

Why it matters to the business

An internet-facing or internally reachable Windows server using the vulnerable HTTP stack could be compromised without credentials or user interaction. This can lead to service outage, data theft, malware deployment, lateral movement, and full takeover of affected Windows systems. The impact is especially significant for organizations running Windows Server, IIS, web services, management endpoints, or products that depend on HTTP.sys. Although this issue is older, the high EPSS score and available exploit maturity mean that long-lived unpatched systems remain attractive targets for opportunistic scanning and automated exploitation.

How an attack unfolds

An attacker first identifies a Windows host exposing an HTTP service backed by HTTP.sys, commonly through IIS, Windows-hosted web services, or other services listening on HTTP or HTTPS. The attacker then sends a malformed HTTP request designed to exercise the vulnerable HTTP Trailer Support parsing path in HTTP.sys. The request is processed before application-level authentication or routing decisions occur, so no valid account or user interaction is required. If the host is vulnerable and the relevant HTTP.sys code path is reachable, the malformed request can corrupt memory in the kernel-mode HTTP stack. Depending on exploit reliability, this may crash the system or allow the attacker to execute code with elevated privileges. After successful code execution, the attacker would typically establish persistence, deploy tooling, access local data, and attempt lateral movement to additional systems.

How to fix it

Apply the Microsoft security updates released in January 2022 or any later cumulative update for all affected Windows versions, including Windows 10, Windows 11, Windows Server, and Windows Server 2019 systems. Where immediate patching is not possible, reduce exposure by removing unnecessary HTTP/HTTPS listeners, restricting access to trusted networks, placing vulnerable services behind patched reverse proxies or load balancers, and blocking direct internet access to affected Windows HTTP.sys services. Microsoft documented that disabling HTTP Trailer Support can mitigate the vulnerable code path on some systems by setting the registry value HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\EnableTrailerSupport to 0 as a DWORD value, followed by restarting the HTTP service or rebooting the system; test this carefully because it can affect services that rely on HTTP trailer functionality. Mitigation should be treated as temporary and not a substitute for applying Windows cumulative updates.

How to confirm the fix worked

Confirm that affected Windows systems have January 2022 or later cumulative security updates installed for their specific OS build. Validate through Windows Update, enterprise patch management, or commands such as Get-HotFix and OS build checks against Microsoft’s release history. Confirm whether HTTP.sys-backed services are exposed by reviewing IIS bindings, HTTP.sys URL reservations, listening ports, and network scan results for HTTP/HTTPS services. Where the registry mitigation is used, verify that HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\EnableTrailerSupport exists as a DWORD and is set to 0, then confirm the HTTP service or system has been restarted. External validation should include authenticated vulnerability scanning or configuration assessment rather than relying only on banner checks, because HTTP.sys exposure can exist behind many different Windows services.

Typical attack path

1. Scan for Windows HTTP/HTTPS services exposed to the internet or reachable from internal networks.
2. Fingerprint likely HTTP.sys-backed services, such as IIS or Windows-native HTTP listeners.
3. Send a specially crafted HTTP request that reaches the vulnerable HTTP.sys trailer-processing code path.
4. Trigger memory corruption in the Windows HTTP Protocol Stack before application-level authentication is required.
5. Achieve remote code execution or cause denial of service depending on exploit reliability and target conditions.
6. Deploy follow-on payloads, create persistence, collect credentials, and move laterally if code execution succeeds.

How to detect it

To determine whether exploitation was already attempted or successful, review HTTP access logs, reverse proxy logs, WAF logs, IIS logs, Windows Event Logs, crash dumps, EDR telemetry, and network packet captures for suspicious requests containing HTTP trailer headers, malformed chunked transfer encoding, or unusual request parsing failures. Focus on internet-facing and internally reachable Windows systems that were not patched with January 2022 or later cumulative updates. In IIS logs, look for abnormal requests around service crashes, unexpected 400-series responses, repeated malformed requests, or requests lacking normal user-agent and URI patterns. In Windows logs, investigate unexpected restarts, bug checks, HTTP service failures, kernel-mode crashes, or application pool instability around the same timestamps. Because successful exploitation may transition quickly to post-exploitation, also hunt for suspicious process execution, new services, scheduled tasks, new local users, credential dumping behavior, unusual PowerShell or command shell activity, and outbound connections shortly after suspicious HTTP traffic. There are no universal exploit payload strings for this vulnerability, so detection should combine patch/exposure status, trailer-related HTTP anomalies, crash telemetry, and endpoint post-exploitation indicators.

• Transfer-Encoding: chunked
• Trailer:
• EnableTrailerSupport
• HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\EnableTrailerSupport
• \SystemRoot\System32\drivers\HTTP.sys
• C:\Windows\System32\drivers\HTTP.sys
• Faulting module name: HTTP.sys
• The HTTP service terminated unexpectedly
• Event ID 7031
• Event ID 1001
• BugCheck
• w3wp.exe
• http.sys

What your security team should do

• Prioritize patching any internet-facing Windows servers or endpoints exposing HTTP/HTTPS services that may use HTTP.sys.
• Patch internally reachable Windows servers next, especially IIS servers, management portals, application servers, and systems reachable from user or DMZ networks.
• Hunt for suspicious HTTP requests containing trailer-related headers, malformed chunked transfer encoding, service crashes, and unexpected HTTP.sys or kernel fault events around exposed services.
• If immediate patching is delayed, restrict access to affected HTTP/HTTPS services and consider disabling HTTP Trailer Support after compatibility testing.
• Run vulnerability scans and asset queries to identify Windows 10, Windows 11, Windows Server, and Windows Server 2019 systems missing January 2022 or later cumulative updates.
• Review post-exploitation telemetry on any previously exposed unpatched host, including new services, scheduled tasks, local administrator changes, suspicious child processes, and outbound command-and-control traffic.
• Treat legacy or rarely rebooted Windows servers as high priority because this vulnerability has public exploit availability and a very high EPSS score despite not being in CISA KEV.