Active Directory Domain Services Elevation of Privilege Vulnerability
Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.
FAQ
What privileges could be gained by an attacker who successfully exploited this vulnerability? An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
FAQ
How could an attacker exploit this vulnerability? An attacker could exploit this issue by adding specially crafted Unicode characters to duplicate Service Principal Names (SPNs) or User Principal Names (UPNs). These characters bypass normal Active Directory checks designed to prevent duplicates. If the attacker has permission to modify SPNs on any account, they can create a duplicate SPN for a targeted service. When clients request Kerberos authentication for that service, the domain controller may issue a ticket encrypted with the wrong key, causing the service to reject the ticket. This can lead to a denial of service or force the service to fall back to NTLM authentication if it is enabled. No access to the targeted server is required beyond the initial SPN‑write permission.