CVE-2021-36942: Windows LSA Spoofing Vulnerability

CVE-2021-36942 Overview

CVE-2021-36942 is a Windows LSA (Local Security Authority) spoofing vulnerability affecting multiple versions of Microsoft Windows Server. This vulnerability, commonly associated with the "PetitPotam" attack technique, allows an unauthenticated attacker to coerce a domain controller to authenticate to an attacker-controlled server using NTLM authentication. This can lead to complete domain compromise when combined with Active Directory Certificate Services (AD CS) relay attacks.

Critical Impact

This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog. Attackers can leverage this flaw to force Windows domain controllers to authenticate against malicious servers, potentially leading to full Active Directory domain compromise through NTLM relay attacks.

Affected Products

• Microsoft Windows Server 2004
• Microsoft Windows Server 2008 (SP2 and R2 SP1)
• Microsoft Windows Server 2012 (including R2)
• Microsoft Windows Server 2016
• Microsoft Windows Server 2019
• Microsoft Windows Server 20H2

Discovery Timeline

• August 12, 2021 - CVE-2021-36942 published to NVD
• October 30, 2025 - Last updated in NVD database

Technical Details for CVE-2021-36942

Vulnerability Analysis

The Windows LSA Spoofing vulnerability exists in the Encrypting File System Remote Protocol (MS-EFSRPC). The flaw allows an unauthenticated attacker to call methods within the MS-EFSRPC interface that coerce the target server into authenticating to an arbitrary server using NTLM. This authentication coercion attack, known as "PetitPotam," exploits improper access control in the EfsRpcOpenFileRaw function and related EFS API calls.

When exploited against a domain controller, the attacker can capture the NTLM authentication attempt and relay it to Active Directory Certificate Services (AD CS) to obtain a certificate for the domain controller's machine account. This certificate can then be used to request a Kerberos Ticket Granting Ticket (TGT) for the domain controller, effectively granting the attacker domain administrator privileges.

Root Cause

The root cause of this vulnerability lies in improper authentication enforcement within the MS-EFSRPC interface. The EFS RPC methods do not properly validate or restrict which entities can trigger authentication requests from the server. This allows unauthenticated remote attackers to abuse these RPC calls to force the target server to initiate NTLM authentication to attacker-controlled destinations without proper authorization checks.

Attack Vector

The attack is network-based and requires no user interaction or prior authentication. An attacker can exploit this vulnerability by sending specially crafted RPC calls to the vulnerable server's MS-EFSRPC interface. The attack flow typically involves:

1. The attacker sets up a malicious server to capture NTLM authentication attempts
2. The attacker sends crafted EFS RPC requests to the target domain controller
3. The domain controller attempts to authenticate to the attacker's server using NTLM
4. The attacker relays the captured NTLM authentication to AD CS
5. AD CS issues a certificate for the domain controller's machine account
6. The attacker uses the certificate to impersonate the domain controller and compromise the domain

The vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely across the network. For detailed technical information, refer to the Microsoft Security Advisory and the CERT Vulnerability Report #405600.

Detection Methods for CVE-2021-36942

Indicators of Compromise

• Unusual outbound NTLM authentication attempts from domain controllers to external or unexpected internal IP addresses
• Event ID 4624 logon events showing domain controller machine accounts authenticating to unknown systems
• Anomalous certificate requests to AD CS from domain controller machine accounts
• Network traffic to the MS-EFSRPC named pipe (\pipe\efsrpc) from unusual sources

Detection Strategies

• Monitor for RPC traffic targeting the MS-EFSRPC interface (\pipe\efsrpc, \pipe\lsarpc, \pipe\samr, \pipe\netlogon) from unexpected sources
• Implement network monitoring rules to detect NTLM relay attack patterns, particularly authentication attempts followed by AD CS certificate requests
• Enable Windows Security event logging and monitor for Event IDs 4624, 4648, and 4768 involving domain controller machine accounts
• Deploy SentinelOne agents on domain controllers to detect suspicious process behavior and authentication anomalies

Monitoring Recommendations

• Configure alerts for any NTLM authentication attempts initiated by domain controllers to non-standard destinations
• Implement Extended Protection for Authentication (EPA) monitoring on critical services
• Review AD CS certificate issuance logs for unexpected certificates issued to machine accounts
• Monitor RPC endpoint activity on domain controllers for MS-EFSRPC method invocations

How to Mitigate CVE-2021-36942

Immediate Actions Required

• Apply the Microsoft security update released in August 2021 that addresses this vulnerability
• Disable NTLM authentication on domain controllers where possible, or restrict NTLM traffic to only known, trusted hosts
• Enable Extended Protection for Authentication (EPA) on AD CS and other sensitive services
• Implement SMB signing and LDAP signing/channel binding to prevent relay attacks
• Consider disabling the EFS service on domain controllers if not required

Patch Information

Microsoft released a security update addressing CVE-2021-36942 as part of the August 2021 Patch Tuesday release. The patch modifies the MS-EFSRPC interface to prevent unauthenticated NTLM authentication coercion. Organizations should apply this update immediately to all affected Windows Server installations. For complete patch details and download links, see the Microsoft Security Advisory CVE-2021-36942.

Workarounds

• Disable NTLM authentication entirely using Group Policy where operationally feasible
• Block inbound SMB traffic (port 445) from untrusted networks to domain controllers
• Configure Windows Firewall rules to restrict access to RPC endpoints on domain controllers
• Implement network segmentation to limit which systems can communicate with domain controllers

# Disable NTLM on domain controllers via registry (requires restart)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v LmCompatibilityLevel /t REG_DWORD /d 5 /f

# Disable the EFS service if not required
sc config EFS start= disabled
sc stop EFS