CVE-2021-36942
Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability
Description
CVE-2021-36942 is a high-severity spoofing vulnerability in the Microsoft Windows Local Security Authority (LSA). This vulnerability, widely known as "PetitPotam," allows an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM, potentially leading to a full domain compromise. Multiple Windows Server versions are affected, including Windows Server 2008, 2012, 2016, 2019, and 2022-era releases. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and it is known to have been used in ransomware campaigns. With an EPSS score of 93.55% (99.83rd percentile), CVE-2021-36942 represents a near-certain exploitation threat.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows server 2004 | < 10.0.19041.1165 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4583 |
| microsoft | windows server 2019 | < 10.0.17763.2114 |
| microsoft | windows server 20h2 | < 10.0.19042.1165 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942(Patch, Vendor Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36942(Patch, Vendor Advisory)
- https://www.kb.cert.org/vuls/id/405600(Exploit, Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36942(US Government Resource)
Weakness Type
Windows LSA Spoofing / NTLM Relay
This vulnerability exploits a flaw in the Windows Local Security Authority (LSA) service's LSARPC interface. The weakness allows an unauthenticated attacker to coerce a domain controller into initiating an NTLM authentication request to an attacker-controlled server. This NTLM relay attack can be leveraged to authenticate as the domain controller against Active Directory Certificate Services (AD CS), ultimately enabling the attacker to obtain a certificate that grants domain administrator privileges. The vulnerability is particularly severe because it requires no authentication and can be exploited remotely over the network.
Learn more: CVE-2021-36942 — Microsoft Security Advisory
Impact Analysis
CVE-2021-36942 carries a CVSS 3.1 score of 7.5 (HIGH), but its real-world impact is substantially greater than the CVSS score suggests due to its use in domain compromise attack chains. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and no user interaction. Confidentiality (High): An attacker can coerce NTLM authentication from the domain controller, potentially capturing credentials that provide complete access to the Active Directory environment. Integrity (None): The vulnerability itself does not directly modify data, but the resulting NTLM relay attack chain can lead to complete domain compromise. Availability (None): No direct availability impact from the spoofing attack. The scope is unchanged, but when combined with NTLM relay to AD CS, the attacker can achieve full domain administrator access. This vulnerability has been confirmed in ransomware campaigns, making it a critical threat to enterprise environments.
Exploit Maturity
CVE-2021-36942 has a highly mature exploit landscape as the core component of the "PetitPotam" attack technique. CISA has confirmed active exploitation in the wild through its KEV catalog listing, and the vulnerability is known to have been leveraged in ransomware attacks. Public exploit information is available via CERT/CC Vulnerability Note VU#405600, which documents the NTLM relay attack vector. The EPSS score of 93.55% (99.83rd percentile) indicates near-certain exploitation activity, placing this among the most actively targeted vulnerabilities. The PetitPotam attack is particularly devastating because it can be chained with NTLM relay to Active Directory Certificate Services (AD CS) to achieve full domain compromise without any authentication. Federal agencies were required to remediate by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Microsoft released security updates in August 2021 to address this vulnerability.
- Update all affected Windows Server systems to patched versions: Windows Server 2004 (>= 10.0.19041.1165), Windows Server 2016 (>= 10.0.14393.4583), Windows Server 2019 (>= 10.0.17763.2114), Windows Server 20H2 (>= 10.0.19042.1165), and all versions of Windows Server 2008 and 2012.
- Disable NTLM authentication where possible and enforce Kerberos-only authentication. If NTLM cannot be fully disabled, enable Extended Protection for Authentication (EPA) on all services, particularly Active Directory Certificate Services (AD CS).
- Enable SMB signing and LDAP signing on all domain controllers to prevent NTLM relay attacks. Additionally, configure AD CS to require EPA and disable HTTP-based certificate enrollment endpoints that are susceptible to relay attacks.
- Monitor for indicators of PetitPotam exploitation, including unusual NTLM authentication requests originating from domain controllers, unexpected certificate enrollment activity, and suspicious LSARPC calls. Implement network segmentation to limit the attack surface of domain controllers.
Technical Details
CVE-2021-36942 is a spoofing vulnerability in the Windows LSA service, commonly known as the "PetitPotam" attack. The vulnerability resides in the Encrypting File System Remote (EFSRPC) protocol accessible through the LSARPC named pipe. An unauthenticated attacker can call EfsRpcOpenFileRaw or related EFSRPC functions to coerce the target server (typically a domain controller) into initiating an NTLM authentication request to an attacker-controlled host. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects that the attack is network-based with low complexity, no privileges required, and no user interaction needed, with the primary impact being on confidentiality through credential exposure. While the CVSS score of 7.5 reflects only the direct spoofing impact, the vulnerability is far more dangerous in practice when combined with NTLM relay attacks against AD CS, enabling full domain compromise from an unauthenticated position.
Frequently Asked Questions
Is CVE-2021-36942 being actively exploited?
Yes. CVE-2021-36942, known as "PetitPotam," is listed in the CISA Known Exploited Vulnerabilities catalog with confirmed active exploitation. It has been used in ransomware campaigns. The EPSS score of 93.55% (99.83rd percentile) indicates near-certain exploitation activity.
What products are affected by CVE-2021-36942?
CVE-2021-36942 affects Microsoft Windows Server systems, including Windows Server 2004, Server 2008 (including R2), Server 2012 (including R2), Server 2016, Server 2019, and Server 20H2. It primarily targets domain controllers but can affect any Windows Server running the LSARPC service.
How do I fix CVE-2021-36942?
Apply the August 2021 Microsoft security updates for all affected Windows Server systems. Additionally, disable NTLM authentication where possible, enable Extended Protection for Authentication on AD CS, enforce SMB and LDAP signing, and monitor for PetitPotam exploitation indicators.
How severe is CVE-2021-36942?
CVE-2021-36942 has a CVSS 3.1 score of 7.5 (HIGH), but its practical severity is much higher because it enables full Active Directory domain compromise when combined with NTLM relay attacks. It has been used in ransomware campaigns and has an EPSS score in the 99.83rd percentile, making it an extremely high-priority vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.