Active Directory Domain Services权限提升漏洞 (CVE-2022-26923) 安全风险通告

Active Directory Domain Services 权限提升漏洞

公开时间

2022-05-11

更新时间

2022-05-13

CVE编号

CVE-2022-26923

其他编号

QVD-2022-6697

威胁类型

权限提升

技术类型

权限、特权和访问控制不正确

厂商

Microsoft

产品

Active Directory

风险等级

奇安信CERT风险评级

风险等级

高危

蓝色（一般事件）

漏洞描述

Active Directory Domain Services存在权限提升漏洞，该漏洞允许具有域内普通用户权限的攻击者在安装了 Active Directory 证书服务 (AD CS) 服务器角色的默认 Active Directory 环境中将权限提升到域管理员权限。攻击者在获取到了低权限账户可以创建机器账户，由于Windows并未对机器账户的dNSHostName属性做唯一性判断，导致攻击者可以修改该机器账户的dNSHostName属性与域控的dNSHostName属性一致，并向证书服务请求颁发证书，证书服务会向攻击者颁发证书，该证书关联于域管理员身份，攻击者通过该证书向域控发起基于证书的身份验证即可获取到域管理员的身份权限。

影响版本

Windows Server 2012 R2 (Server Core installation)
  Windows Server 2012 R2
  Windows RT 8.1
  Windows 8.1 for x64-based systems
  Windows 8.1 for 32-bit systems
  Windows Server 2016  (Server Core   installation)
  Windows Server 2016
  Windows 10 Version 1607 for x64-based Systems
  Windows 10 Version 1607 for 32-bit Systems
  Windows 10 for x64-based Systems
  Windows 10 for 32-bit Systems
  Windows 10 Version 21H2 for x64-based Systems
  Windows 10 Version 21H2 for ARM64-based Systems
  Windows 10 Version 21H2 for 32-bit Systems
  Windows 11 for ARM64-based Systems
  Windows 11 for x64-based Systems
  Windows Server, version 20H2 (Server Core Installation)
  Windows 10 Version 20H2 for ARM64-based Systems
  Windows 10 Version 20H2 for 32-bit Systems
  Windows 10 Version 20H2 for x64-based Systems
  Windows Server 2022 (Server Core installation)
  Windows Server 2022
  Windows 10 Version 21H1 for 32-bit Systems
  Windows 10 Version 21H1 for ARM64-based Systems
  Windows 10 Version 21H1 for x64-based Systems
  Windows 10 Version 1909 for ARM64-based Systems
  Windows 10 Version 1909 for x64-based Systems
  Windows 10 Version 1909 for 32-bit Systems
  Windows Server 2019  (Server Core   installation)
  Windows Server 2019
  Windows 10 Version 1809 for ARM64-based Systems
  Windows 10 Version 1809 for x64-based Systems
  Windows 10 Version 1809 for 32-bit Systems

不受影响版本

无

其他受影响组件

无