Dangerous ACLs expose Certificate Templates container

This vulnerability enables non-default principals to introduce a malicious CA, which can lead to privilege escalation and domain compromise. An attacker with elevated permissions on the Certificate Templates container can create or modify certificate templates to issue rogue certificates, bypassing security controls and gaining unauthorized access to sensitive resources through reconnaissance and persistence.

Attackers can use the elevated permissions on the Certificate Templates container to create or modify certificate templates that issue rogue certificates. These certificates can be used to authenticate malicious entities, allowing them to access sensitive resources and escalate privileges.

Cayosoft Guardian continuously monitors the permissions on the Certificate Templates container in Active Directory. When it detects non-default principals with elevated permissions, Guardian flags it as a security issue so administrators can take action to remediate.

Cayosoft Guardian alerts administrators to remove unexpected permissions on the Certificate Templates container, ensuring that only authorized principals have access. This reduces the risk of privilege escalation and domain compromise by preventing malicious entities from issuing rogue certificates.