【漏洞通告】Active Directory Domain Services权限提升漏洞（CVE-2022-26923）

0x00 漏洞概述

0x01 漏洞详情

2022 年 5 月 10 日，微软发布了5月安全更新，修复了包括Active Directory Domain Services权限提升漏洞（CVE-2022-26963 ）在内的75个安全漏洞。

该漏洞的CVSSv3评分为8.8，经过身份验证的低权限用户可以利用此漏洞在安装了 Active Directory 证书服务 (AD CS) 服务器角色的默认 Active Directory 环境中将权限提升为域管理员权限。但只有当Active Directory 证书服务在域上运行时，系统才容易受到针对此漏洞的攻击。

5月11日，此漏洞的漏洞细节和POC已公开。

使用证书进行身份验证（来源：互联网）

转储所有用户哈希（来源：互联网）

影响范围

Windows Server 2012 R2 (Server Core installation)

Windows Server 2012 R2

Windows RT 8.1

Windows 8.1 for x64-based systems

Windows 8.1 for 32-bit systems

Windows Server 2016 (ServerCore installation)

Windows Server 2016

Windows 10 Version 1607 for x64-based Systems

Windows 10 Version 1607 for 32-bit Systems

Windows 10 for x64-based Systems

Windows 10 for 32-bit Systems

Windows 10 Version 21H2 for x64-based Systems

Windows 10 Version 21H2 for ARM64-based Systems

Windows 10 Version 21H2 for 32-bit Systems

Windows 11 for ARM64-based Systems

Windows 11 for x64-based Systems

Windows Server, version 20H2 (Server Core Installation)

Windows 10 Version 20H2 for ARM64-based Systems

Windows 10 Version 20H2 for 32-bit Systems

Windows 10 Version 20H2 for x64-based Systems

Windows Server 2022 (Server Core installation)

Windows Server 2022

Windows 10 Version 21H1 for 32-bit Systems

Windows 10 Version 21H1 for ARM64-based Systems

Windows 10 Version 21H1 for x64-based Systems

Windows 10 Version 1909 for ARM64-based Systems

Windows 10 Version 1909 for x64-based Systems

Windows 10 Version 1909 for 32-bit Systems

Windows Server 2019 (ServerCore installation)

Windows Server 2019

Windows 10 Version 1809 for ARM64-based Systems

Windows 10 Version 1809 for x64-based Systems

Windows 10 Version 1809 for 32-bit Systems

0x02 安全建议

目前微软已经发布了此漏洞的补丁，鉴于Active Directory服务使用广泛，且漏洞影响较为严重，建议受影响用户尽快安装更新。

下载链接：

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26923

0x03 参考链接

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26923

https://research.ifcr.dk/certifried-active-directory-domain-privilege-escalation-cve-2022-26923-9e098fe298f4

0x04 版本信息

0x05 附录

原文始发于微信公众号（维他命安全）：【漏洞通告】Active Directory Domain Services权限提升漏洞（CVE-2022-26923）