During penetration tests and also for attackers searching the network for potential targets, insights into the configuration of the certification authority are highly interesting.
In addition to possible misconfigurations, attackers can obtain information about the policy module used on the certification authority.
Nowadays, it is essential to protect the authentication of devices on the company network and administrative interfaces. As a rule, digital certificates are used for this purpose.
Printers therefore also generally require digital certificates in order to be operated securely. From a certain number of devices, there is no getting around automatic certificate distribution.
Some printer manufacturers offer centralized management solutions for certificate distribution.
Unfortunately, it has been shown time and again that the secure handling of digital certificates requires a great deal of knowledge, experience and care, which is often not the case.
Starting with version 58, Google has decided to remove support for the Subject Distinguished Name of web server certificates in the Chrome browser and instead only accept certificates with Subject Alternative Name.
Since then, web server certificates without a Subject Alternative Name in the form of a dNSName have been rejected by Google Chrome and other Chromium -based browsers (i.e. also Microsoft Edge ). Other browser manufacturers quickly adopted this approach, so that this problem now affects all popular browsers.
With the supposedly good intention of making it possible to issue such certificate requests with a SAN, unfortunately far too many guides advise enabling the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the certification authority.
If this flag is enabled, a very large attack surface is offered, as any enrollee can now instruct the certification authority to issue certificates with any content. This type of attack is known in the security scene as ESC6 and ESC7 .
On the internet, there are unfortunately far too many instructions (the big players are not excluded from this , not even Microsoft itself or the grandmaster Komar ), which fatally recommend that the flag EDITF_ATTRIBUTESUBJECTALTNAME2 should be set on the certification authority - supposedly to be able to issue certificates with Subject Alternative Name (SAN) extension for manually submitted certificate requests.
Unfortunately, this procedure is not only unnecessary, it also has some unpleasant side effects, which in the worst case can help an attacker to take over the entire Active Directory forest .
Unfortunately, far too many instructions are circulating online (the big players are not exempt from this either, not even Microsoft itself or the grand master Komar ), which fatally recommend setting the EDITF_ATTRIBUTESUBJECTALTNAME2 flag on the certification authority - supposedly so that one would be able to issue certificates with a Subject Alternative Name (SAN) extension for manually submitted certificate requests.
Unfortunately, this approach is not only unnecessary, it also has some unpleasant side effects, which in the worst case can help an attacker to take over the entire Active Directory forest.
Continue reading "Active Directory forest compromised by EDITF_ATTRIBUTESUBJECTALTNAME2 flag"