Active Directory bugs could let hackers take over Windows domain controllers

Microsoft is urging customers to patch two security vulnerabilities in Active Directory domain controllers that it addressed in November, following the release of a proof-of-concept (PoC) tool on 12 December.

The two vulnerabilities, tracked as CVE-2021-42278 and CVE-2021-42287, have severity scores of 7.5 out of 10 and concern privilege-escalation flaws affecting Active Directory Domain Services (AD DS). Catalyst IT's Andrew Bartlett was credited with discovering and reporting both bugs.

Active Directory is a directory service running on Microsoft Windows Server, used for identity and access management. Although Microsoft classified exploitation as less likely in its assessment, the public release of the PoC prompted renewed calls to apply the fixes and reduce the risk of exploitation by threat actors.

CVE-2021-42278 allows an attacker to spoof the SAM-Account-Name attribute used to sign users into systems in an Active Directory domain, while CVE-2021-42287 allows impersonation of domain controllers. This effectively lets a malicious user with domain-user credentials gain access as a domain administrator.

"By combining these two vulnerabilities, an attacker can create a straightforward path to a domain administrator in an Active Directory environment that has not applied these new updates," Microsoft senior product manager Daniel Naim said. "This escalation attack lets attackers easily raise their privileges to those of a Domain Admin once they compromise a regular domain user."

The Redmond-based company also provided a step-by-step guide to help users determine whether the vulnerabilities may have been exploited in their environments. "As always, we strongly recommend deploying the latest patches to domain controllers as soon as possible," Microsoft said.