Certighost and the Privilege Hiding in Your Certificate Authority

The Vulnerability Is New. The Hidden Privilege Isn’t.

Certighost exposed how privilege buried in trusted relationships and overlooked defaults can become a path to domain compromise. BeyondTrust’s complimentary Identity Security Risk Assessment helps you uncover those hidden identity and privilege exposures across your own environment before they become the next path attackers exploit.

This is not a certificate bug. It is a privilege and trust failure. It is tempting to file Certighost under PKI arcana, assign it to whoever owns the CA, and move on once the patch lands. Strip away the certificate machinery and look at the shape of the attack: an unprivileged identity manipulated a trusted system into vouching for a privileged identity, and the environment had no mechanism to question the result. That is a trust-validation problem that sits at the core of identity security.

The Certification Authority is not a passive appliance. It is a privileged identity in its own right, one that manufactures trust on behalf of the entire domain. The patch Microsoft shipped is, at its heart, a verification step enforcing that the target of a chase lookup is genuinely a Domain Controller. That is the recurring signature of identity-driven compromise: the attacker rarely breaks cryptography or authentication. They find the place where the system decided to trust without checking.

There is a second, more uncomfortable lesson buried in the prerequisites. The default configuration of Active Directory grants every authenticated user a small piece of standing privilege: the ability to create machine accounts, courtesy of a MachineAccountQuota that permits it by default. Certighost is one of many attack chains that quietly depend on that standing capability. The specific CVE is new, but the latent privilege it leaned on has been sitting in your domain for years. The vulnerability created a shortcut, but the terrain was already dangerous. A determined attacker who lands a single low-privileged foothold has a realistic path to domain dominance because privilege has accumulated in places no one is actively governing: overbroad certificate template permissions, permissive machine account defaults, flat trust between the CA and the domain, and monitoring that watches endpoints but not the identity control plane.

Certighost is a clean demonstration of how those conditions can be exploited. The attack relies on the CA’s ability to follow requester-supplied routing information (a parameter called cdc) to look up the target object elsewhere. The defect is that the CA never verifies that the endpoint named in cdc is a legitimate Domain Controller before it reaches out to it. An attacker points cdc at a machine they control and the CA dutifully makes an outbound connection to that rogue endpoint, which answers with forged identity data, including the target Domain Controller’s object security identifier and DNS host name. The CA trusts what it is told, binds that identity to a signed X.509 certificate, and hands the attacker a certificate that says they are a Domain Controller.