Skip to content

ESC6 Vulnerability

The ESC6 vulnerability is a critical flaw in Microsoft's Active Directory Certificate Services (AD CS) that allows unauthorized certificate issuance through improper validation of enrollment requests. This vulnerability arises when the Certificate Enrollment Web Service (CEWS) or Certificate Enrollment Policy Web Service (CEPWS) fails to enforce strict validation of certificate request attributes, enabling attackers to bypass access controls and issue certificates for arbitrary subjects. ESC6 is part of a series of vulnerabilities (ESC1–ESC10) that target AD CS's certificate enrollment process, highlighting the importance of securing certificate infrastructure.

Attack Surface and Exploitation Method

The attack surface for ESC6 includes:
1. CEWS/CEPWS Services: These services handle certificate enrollment requests and are often exposed to the internet or internal networks.
2. Misconfigured Enrollment Policies: Weak or overly permissive policies in the Certification Authority (CA) can allow unauthorized users to submit requests.
3. Unauthenticated Communication: If CEWS/CEPWS is not configured to require HTTPS with TLS, attackers can intercept or manipulate requests.

Exploitation Steps:
1. An attacker crafts a malicious certificate request with invalid or spoofed attributes (e.g., subject name, SAN).
2. The request is submitted to CEWS/CEPWS without proper authentication or validation.
3. The CA issues a certificate without verifying the requester's identity or permissions, granting the attacker access to network resources or privileges.

This vulnerability is particularly dangerous in environments where certificates are used for authentication, encryption, or access control.

Defensive Configurations

To mitigate ESC6 and similar vulnerabilities, implement the following:

1. Secure CEWS/CEPWS Configuration

  • Enforce HTTPS: Use TLS 1.2 or higher with strong cipher suites to encrypt communication.
  • Restrict Access: Configure firewall rules to limit access to CEWS/CEPWS to trusted IP ranges.
  • Disable Unnecessary Ports: Ensure ports (e.g., 7712 for CEWS) are not exposed to the public internet.

Example:

# Enable HTTPS for CEWS using PowerShell  
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Cryptography\CA" -Name "EnableHTTPS" -Value 1

2. Enforce Strict Enrollment Policies

  • Subject Name Validation: Ensure policies require matching subject names in requests with pre-approved templates.
  • Certificate Templates: Use templates with strict constraints (e.g., User or Computer types) and disable Allow Enroll for untrusted templates.

Example:

# Check certificate template settings via PowerShell  
Get-CertificationAuthority | Get-CATemplate -Name "User Enrollment"

3. Patch and Update

  • Apply Microsoft updates that address ESC6 (e.g., cumulative updates for AD CS).
  • Verify patch compatibility with your AD CS version (Windows Server 2012 R2, 2016, 2019, or 2022).

4. Audit and Monitor

  • Regularly review logs for suspicious enrollment activity using Event Viewer (Event IDs 4114, 4115).
  • Implement SIEM tools to detect anomalies in certificate issuance patterns.

Key Takeaways

  • ESC6 exploits weak validation in AD CS enrollment services, allowing unauthorized certificate issuance.
  • Secure CEWS/CEPWS with HTTPS, access controls, and firewall rules to reduce exposure.
  • Enforce strict certificate templates and policies to prevent misuse of enrollment privileges.
  • Apply patches and monitor logs to detect and respond to exploitation attempts.
  • Regularly audit certificate issuance to ensure compliance with organizational security policies.