Skip to content
OpenAdvisories
Critical · 9.8 Exploitation more likely Public exploit CVE-2022-21907 EUVD-2022-27063GHSA-cgqq-62rg-6vmf

HTTP Protocol Stack Remote Code Execution Vulnerability

Published Jan 11, 2022 · Updated Jan 2, 2025 · Assigned by microsoft

Vendor: Microsoft Product: Windows 10 Version 1809 Product: Windows 10 Version 20H2 Product: Windows 10 Version 21H1 Product: Windows 10 Version 21H2 Product: Windows 11 version 21H2 Product: Windows Server 2019 Product: Windows Server 2019 (Server Core installation) Product: Windows Server 2022 Product: Windows Server version 20H2 Platform: Windows

Description

HTTP Protocol Stack Remote Code Execution Vulnerability

Affected products

VendorProductAffectedFixed
Microsoft Windows 10 Version 1809 10.0.17763.0 – < 10.0.17763.2452, 10.0.0 – < 10.0.17763.2452 10.0.17763.2452
Microsoft Windows Server 2019 10.0.17763.0 – < 10.0.17763.2452 10.0.17763.2452
Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.0 – < 10.0.17763.2452 10.0.17763.2452
Microsoft Windows 10 Version 21H1 10.0.0 – < 10.0.19043.1466 10.0.19043.1466
Microsoft Windows Server 2022 10.0.20348.0 – < 10.0.20348.469 10.0.20348.469
Microsoft Windows 10 Version 20H2 10.0.0 – < 10.0.19042.1466 10.0.19042.1466
Microsoft Windows Server version 20H2 10.0.0 – < 10.0.19042.1466 10.0.19042.1466
Microsoft Windows 11 version 21H2 10.0.0 – < 10.0.22000.434 10.0.22000.434
Microsoft Windows 10 Version 21H2 10.0.19043.0 – < 10.0.19044.1466 10.0.19044.1466

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 16 repositories · most starred shown

  • ZZ-SOCMAP/CVE-2022-21907 ★ 358 · Jan 17, 2022

    HTTP Protocol Stack Remote Code Execution Vulnerability CVE-2022-21907

  • polakow/CVE-2022-21907 ★ 126 · Apr 4, 2022

    A REAL DoS exploit for CVE-2022-21907

  • p0dalirius/CVE-2022-21907-http.sys ★ 82 · Jan 17, 2022

    Proof of concept of CVE-2022-21907 Double Free in http.sys driver, triggering a kernel crash on IIS servers

  • michelep/CVE-2022-21907-Vulnerability-PoC ★ 28 · Jan 23, 2022

    CVE-2022-21907 Vulnerability PoC

  • mauricelambert/CVE-2022-21907 ★ 26 · Jan 15, 2022

    CVE-2022-21907: detection, protection, exploitation and demonstration. Exploitation: Powershell, Python, Ruby, NMAP and Metasploit. Detection and protection: Powershell. Demonstration: Youtube.

  • Malwareman007/CVE-2022-21907 ★ 17 · Oct 29, 2022

    POC for CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability.

  • 0xmaximus/Home-Demolisher ★ 8 · Nov 22, 2022

    PoC for CVE-2021-31166 and CVE-2022-21907

  • corelight/cve-2022-21907 ★ 5 · Jan 11, 2022

    cve-2022-21907

  • gpiechnik2/nmap-CVE-2022-21907 ★ 2 · Apr 16, 2022

    Repository containing nse script for vulnerability CVE-2022-21907. It is a component (IIS) vulnerability on Windows. It allows remote code execution. The vulnerability affects the kernel module http.…

  • iveresk/cve-2022-21907-http.sys ★ 1 · May 10, 2022

    An unauthenticated attacker can send an HTTP request with an "Accept-Encoding" HTTP request header triggering a double free in the unknown coding-list inside the HTTP Protocol Stack (http.sys) to pro…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References