Microsoft AD CS “CertiGhost” Flaw Lets Low‑Privileged Users Forge Domain‑Controller Certificates
What Happened — A vulnerability in Microsoft Active Directory Certificate Services (AD CS) allowed a low‑privilege domain user to request and receive a valid Domain Controller (DC) certificate, effectively enabling DC impersonation. Microsoft released a patch in the July 2024 security updates.
Why It Matters for Compliance & Audit Readiness
- The flaw bypasses logical‑access controls that SOC 2 CC6.1 requires you to design, monitor, and evidence.
- Unchecked certificate issuance creates a blind spot in your continuous‑compliance evidence trail; a patched environment restores the ability to prove proper access‑control enforcement.
- Leveraging Verisq’s SOC 2 Access‑Controls capability helps you map certificate‑issuance processes to audit criteria and collect immutable proof that only authorized accounts can obtain high‑privilege certificates.
Who Is Affected — Enterprises across all sectors that run on‑premises Windows Server with AD CS (e.g., finance, healthcare, manufacturing, SaaS providers).
Recommended Actions
- Verify that the July 2024 patch (KB xxxxxxx) is applied to every AD CS server.
- Review and tighten AD CS enrollment policies: restrict certificate templates to privileged groups only.
- Enable detailed AD CS logging and integrate logs into your SIEM for continuous monitoring of certificate requests.
- Map the certificate‑issuance workflow to SOC 2 CC6.1 controls and capture evidence of policy enforcement for audit readiness.
Source: HackRead – Microsoft Fixes CertiGhost Flaw That Allowed Domain Controller Impersonation
Technical Notes
- Attack vector: Exploitation of a privilege‑escalation vulnerability in AD CS (certificate‑template mis‑configuration).
- CVE: CVE‑2024‑XXXX (publicly disclosed with the July 2024 patch).
- Impact: Ability to obtain a DC‑authenticating certificate → full domain compromise.
- Mitigation: Apply the July 2024 cumulative update; enforce strict enrollment permissions; monitor for anomalous certificate requests.