ADCS ESC1 privilege escalation explained
Active Directory Certificate Services is present in the vast majority of enterprise Windows environments, and ESC1 is one of the most consistently overlooked privilege escalation paths we encounter on internal assessments.
The vulnerability isn't a CVE. It's a combination of four conditions on a certificate template: the template allows the enrollee to supply the subject name, it permits client authentication (meaning the resulting certificate authenticates to AD), Domain Users have enrol rights, and the Certificate Authority accepts requests without manager approval. When all four are present - which they frequently are on templates derived from Microsoft's built-in examples - any standard domain account can request a certificate naming a Domain Admin as the subject. Active Directory trusts it. The domain is compromised, cleanly, with no malware and no exploit code.
The check takes minutes with tooling like Certipy. The fix is also straightforward: remove the ability for enrollees to supply the SAN on any template that permits client authentication, or enforce CA manager approval as a minimum control. Neither remediation requires a significant change programme.
The reason this keeps appearing is that PKI tends to get deployed once and then left alone. Certificate templates rarely get the same scrutiny as firewall rules or patch levels. If your ADCS environment hasn't been reviewed as part of an internal assessment, it's worth adding to the scope.
Concerned this affects you?
We can assess your exposure and tell you plainly where you stand.