Citrix Endpoint Management and XenMobile Server - AD CS ESC1 Vulnerability Risks
Article ID: CTX695678
Updated On:
Description
Action to take:
CEM (Citrix Endpoint Management) or XMS (XenMobile Server) customers who use client certificate authentication or certificate + domain authentication should review their certificate template configurations to ensure least-privilege access.We strongly recommend removing Full Control, Write, Enroll, Autoenroll, or any similar permissions from broad groups such as Authenticated Users, Domain Users, and Domain Computers unless these permissions are explicitly required.Only the designated service accounts should retain the Enroll permission on the certificate template.
Environment
The information outlined above is provided to assist administrators in identifying and mitigating potential AD CS misconfigurations that may introduce security risks. Actual exposure levels depend on environmental factors, certificate template designs, and organizational security policies.
Citrix does not control customer AD CS configurations and cannot guarantee full protection against misuse of certificate templates that deviate from recommended security practices. Administrators are responsible for validating and securing their own PKI infrastructure and applying appropriate permissions in accordance with organizational and industry security standards.
Issue/Introduction
Misconfigurations in Active Directory Certificate Services (AD CS), particularly those related to ESC1, can unintentionally enable privilege escalation through certificate-based attack vectors. These misconfigurations may grant users or service identities excessive control, potentially leading to domain compromise.
Additional Information
For detailed information on certificate template configurations, please refer to the CEM/XMS documentation:
