Skip to main content

Active Directory Forest Trust Vulnerability

Security researchers have discovered a vulnerability in Active Directory (AD) that allows an attacker to achieve lateral movement between AD forests that share two-way trust relationships.

Threat ID:
CC-2826
Category:
exploit
Threat Severity:
Medium
Threat Vector:
Vulnerability
Published:
5 December 2018 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Security researchers have discovered a vulnerability in Active Directory (AD) that allows an attacker to achieve lateral movement between AD forests that share two-way trust relationships.

Threat details

Forests are the top-level containers in the AD logical hierarchy. Microsoft considers each forest to be a security boundary for all contained objects. Administrators from outside a forest should only be able to control access to information within the forest if they gain permission from the forest's own administrators.

The researchers have found that the default configuration can be exploited if an attacker compromises any single server with unconstrained delegation, such as a domain controller. If there are any two-way forest trust relationships, the attacker can then coerce similar servers in other forests to authenticate to the attacker-controlled server by exploiting a known vulnerability in the Windows Print System Remote Protocol (MS-RPRN). This can be leveraged to compromise all domains within the other forests.

Remediation

At the time of publication, Microsoft has indicated that it will not be releasing any security updates to address this vulnerability. The issue may be resolved in a future version of Windows.

There are several suggested steps that can be taken to mitigate the vulnerability:

  • Disable Kerberos full delegation across inter-forest trusts.
  • Enable the selective authentication setting across inter-forest trusts. An attack may still succeed however if (as is often the case) domain controllers are granted the 'allowed to authenticate' right on foreign domain controllers.
  • Consider removing the trusts altogether.
  • Disable the Spooler service on domain controllers, and other servers with un

Remediation steps

Type Step

At the time of publication, Microsoft has indicated that it will not be releasing any security updates to address this vulnerability. The issue may be resolved in a future version of Windows.

There are several suggested steps that can be taken to mitigate the vulnerability:

  • Disable Kerberos full delegation across inter-forest trusts.
  • Enable the selective authentication setting across inter-forest trusts. An attack may still succeed however if (as is often the case) domain controllers are granted the 'allowed to authenticate' right on foreign domain controllers.
  • Consider removing the trusts altogether.
  • Disable the Spooler service on domain controllers, and other servers with unconstrained delegation, to prevent the exploitation of MS-RPRN. A scanner for this vulnerability has been released, but this has not been tested by NHS Digital.
  • Add all accounts on sensitive machines to the Protected Users group or enable the 'account is sensitive and cannot be delegated' setting. Please note that the researchers have not tested this suggestion in a production environment, so there may be unintended consequences.

Last edited: 17 February 2020 12:59 pm