'Certighost' Flaw Haunts Microsoft Active Directory Certificates

A critical vulnerability, dubbed ‘Certighost,’ has been patched by Microsoft that allowed a low-privileged domain user to impersonate a domain controller and compromise an Active Directory environment. The flaw stemmed from a broken trust boundary within the certificate enrollment process, enabling attackers to trick the Certificate Authority into accepting identity data from a controlled host. The researchers, Aniq Fakhrul and Muhammad Ali, responsibly disclosed the flaw to Microsoft, who issued a patch in their July Patch Tuesday updates. While a temporary workaround exists by disabling the vulnerable chase behavior, security teams should consider certificate enrollment as a security boundary rather than plumbing.