CVE-2014-1812
Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability
Description
CVE-2014-1812 is a HIGH privilege escalation vulnerability in Microsoft Windows Group Policy Preferences with a CVSS 3.1 score of 8.8. Microsoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy Preferences (GPP). An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords stored in SYSVOL and use them to elevate privileges on the domain. Affected products include Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The vulnerability is known to be leveraged in ransomware campaigns. With an EPSS score of 0.80264 (99.10th percentile), this vulnerability demonstrates extremely high real-world exploitation probability and demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 7 | - |
| microsoft | windows 8 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows vista | - |
References
- http://blogs.technet.com/b/srd/archive/2014/05/13/ms14-025-an-update-for-group-policy-preferences.aspx(Third Party Advisory)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-025(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-1812(US Government Resource)
Weakness Type
CWE-255: Credentials Management Errors / CWE-522: Insufficiently Protected Credentials
CVE-2014-1812 is classified under CWE-255 (Credentials Management Errors) and CWE-522 (Insufficiently Protected Credentials). CWE-522 occurs when a product transmits or stores authentication credentials using an insecure method that is susceptible to unauthorized interception and retrieval. This includes storing passwords in plaintext, using weak encryption, or failing to properly protect credential stores. When credentials are not adequately protected, attackers who gain any level of access can often retrieve them and escalate their privileges or move laterally through the network.
In the context of Microsoft Windows Group Policy Preferences, this weakness is especially dangerous because GPP allows administrators to embed encrypted passwords in XML files distributed via SYSVOL. However, Microsoft published the AES key used for this encryption in MSDN documentation, making any password stored in a GPP XML file trivially decryptable by any domain user. This fundamentally breaks the credential protection model and turns a convenience feature into a domain-wide privilege escalation vector.
Learn more: CWE-522 — Insufficiently Protected Credentials
Impact Analysis
CVE-2014-1812 carries a CVSS 3.1 score of 8.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation grants the attacker access to passwords stored in Group Policy Preferences XML files on the SYSVOL share. These may include local administrator passwords, service account credentials, and other domain credentials, leading to broad unauthorized access across the network.
Integrity (HIGH): With decrypted credentials, attackers can modify system configurations, install backdoors, alter Group Policy settings, and make unauthorized changes across multiple domain-joined systems.
Availability (HIGH): Using the elevated privileges gained through decrypted credentials, attackers can disrupt services, lock out legitimate accounts, or deploy ransomware across the domain.
Scope Unchanged: The impact is contained within the vulnerable Windows Active Directory environment, though the credentials obtained may provide access to additional systems within the same domain.
With an EPSS score of 0.80264 (99.10th percentile), this vulnerability is among the most exploited in practice and is frequently used as a post-compromise privilege escalation technique.
Exploit Maturity
CVE-2014-1812 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability is trivially exploitable using publicly available tools such as PowerSploit's Get-GPPPassword module and the Metasploit Framework. The decryption key was published by Microsoft in MSDN documentation, making exploitation straightforward for any authenticated domain user.
Ransomware association: This vulnerability is known to be leveraged in ransomware campaigns. Threat actors frequently use GPP password decryption as part of post-compromise lateral movement and privilege escalation chains leading to ransomware deployment.
Attack surface: Any authenticated user on a Windows domain where Group Policy Preferences have been used to set passwords can exploit this vulnerability. The SYSVOL share is readable by all authenticated domain users by default, making the attack surface extremely broad.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03. All organizations should treat this deadline as a strong recommendation for their own remediation timelines.
Remediation
- Apply Microsoft security update MS14-025 immediately. Apply updates per vendor instructions. Consult the Microsoft Security Bulletin MS14-025 for specific patch guidance. Note that this update prevents creation of new GPP with passwords but does not remove existing ones.
- Remove all existing GPP XML files containing passwords from SYSVOL. Search the SYSVOL share for XML files containing the cpassword attribute (Groups.xml, Services.xml, Scheduledtasks.xml, DataSources.xml, Printers.xml, Drives.xml). Delete or replace these files immediately.
- Rotate all credentials that were ever stored in Group Policy Preferences. Any password that was distributed via GPP should be considered compromised. Change all affected local administrator passwords, service account credentials, and any other credentials that were configured through GPP.
- Implement LAPS (Local Administrator Password Solution). Deploy Microsoft LAPS or Windows LAPS to manage local administrator passwords securely, replacing the insecure GPP password distribution mechanism.
- Audit and monitor SYSVOL access. Enable auditing on SYSVOL to detect any access to GPP XML files. Monitor for use of known exploitation tools like Get-GPPPassword.
- Scan for indicators of prior exploitation. Given the widespread exploitation of this vulnerability, review domain logs for evidence of credential abuse, unexpected privilege escalation, or lateral movement patterns consistent with GPP password exploitation.
Technical Details
CVE-2014-1812 is a HIGH-severity vulnerability in Microsoft Windows Group Policy Preferences that can be exploited remotely over the network by any authenticated domain user. The attack complexity is low, requiring no specialized conditions beyond basic domain authentication. Low-level privileges (standard domain user) are sufficient to exploit this vulnerability. No user interaction is required.
Technical mechanism: Group Policy Preferences (GPP) allows administrators to configure settings including local user accounts, scheduled tasks, services, and drive mappings with embedded credentials. These credentials are encrypted using a static AES-256 key and stored in XML files on the SYSVOL share. Microsoft published the AES encryption key in MSDN documentation (KB2962486), making it trivially possible for any authenticated domain user to read the SYSVOL share, extract the cpassword value from GPP XML files, and decrypt the stored credentials using the published key.
CVSS 3.1 vector analysis: The vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a Network Attack Vector (SYSVOL is accessible over the network), Low Attack Complexity (decryption key is publicly known), Low Privileges Required (any authenticated domain user), No User Interaction needed, and HIGH impact across all three CIA dimensions.
Affected products: Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2.
Frequently Asked Questions
Is CVE-2014-1812 being actively exploited?
Yes, CVE-2014-1812 is actively exploited in the wild. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog and has an EPSS score of 0.80264 (99.10th percentile), confirming extremely high exploitation probability. The vulnerability is also known to be leveraged in ransomware campaigns, making it a critical priority for remediation.
What products are affected by CVE-2014-1812?
Affected products include Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2. Any Windows domain where Group Policy Preferences were used to distribute passwords is vulnerable.
How do I fix CVE-2014-1812?
Apply Microsoft Security Bulletin MS14-025, which prevents creation of new GPP entries with passwords. Additionally, manually remove all existing GPP XML files containing cpassword attributes from SYSVOL, rotate all credentials that were ever stored in GPP, and deploy LAPS for local administrator password management.
How severe is CVE-2014-1812?
CVE-2014-1812 is rated HIGH with a CVSS 3.1 score of 8.8. Its EPSS score of 0.80264 places it in the 99.10th percentile for exploitation likelihood. The vulnerability is confirmed in ransomware campaigns and allows any authenticated domain user to decrypt credentials stored in Group Policy Preferences, making it a critical privilege escalation vector.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.