CVE-2024-49019HighCVSS 7.8

Active Directory Certificate Services Elevation of Privilege Vulnerability

Published
November 12, 2024
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2024-49019 →

📋 Description

What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could gain domain administrator privileges.

What types of certificates are vulnerable to this type of attack? Certificates created using a version 1 certificate template with Source of subject name set to "Supplied in the request" are potentially vulnerable if the template is not secured according to the best practices published in the Securing Certificate Templates section of Securing PKI: Technical Controls for Securing PKI | Microsoft Learn.

How do I know if my PKI environment is vulnerable to this type of attack? Check if you have published any certificates created using a version 1 certificate template where the Source of subject name is set to "Supplied in the request" and the Enroll permissions are granted to a broader set of accounts, such as domain users or domain computers. An example is the built-in Web Server template, but it is not vulnerable by default due to its restricted Enroll permissions.

🎯 Affected products19

  • Windows Server 2008 R2 for x64-based Systems Service Pack 1
  • Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
  • Windows Server 2008 for 32-bit Systems Service Pack 2
  • Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
  • Windows Server 2008 for x64-based Systems Service Pack 2
  • Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
  • Windows Server 2012
  • Windows Server 2012 (Server Core installation)
  • Windows Server 2012 R2
  • Windows Server 2012 R2 (Server Core installation)
  • Windows Server 2016
  • Windows Server 2016 (Server Core installation)
  • Windows Server 2019
  • Windows Server 2019 (Server Core installation)
  • Windows Server 2022
  • Windows Server 2022 (Server Core installation)
  • Windows Server 2022, 23H2 Edition (Server Core installation)
  • Windows Server 2025
  • Windows Server 2025 (Server Core installation)

✅ Remediation

KB5046615 (Security Update) — fixed build 10.0.17763.6532 KB5046616 (Security Update) — fixed build 10.0.20348.2849 KB5046698 (SecurityHotpatchUpdate) — fixed build 10.0.20348.2819 KB5046618 (Security Update) — fixed build 10.0.25398.1251 KB5046612 (Security Update) — fixed build 10.0.14393.7515 KB5046661 (Monthly Rollup) — fixed build 6.0.6003.22966 KB5046639 (Security Only) — fixed build 6.0.6003.22966 KB5046687 (Monthly Rollup) — fixed build 6.1.7601.27415 KB5046705 (Security Only) — fixed build 6.1.7601.27415 KB5046697 (Monthly Rollup) — fixed build 6.2.9200.25165 KB5046682 (Monthly Rollup) — fixed build 6.3.9600.22267 KB5046617 (Security Update) — fixed build 10.0.26100.2314 KB5046696 (SecurityHotpatchUpdate) — fixed build 10.0.26100.2240

🔗 References (27)