CVE-2021-42291: 
vulnerability analysis and mitigation

CVE-2021-42291 is a security bypass vulnerability in Microsoft Active Directory Domain Services (AD DS) and Lightweight Directory Service (LDS) that allows certain users to set arbitrary values on security-sensitive attributes of specific objects. The vulnerability was disclosed in November 2021 and affects multiple versions of Windows Server, including Server 2022, 2019, 2016, 2012 R2, 2012, 2008 R2, and 2008 Service Pack 2 (Microsoft Support).

The vulnerability allows users with sufficient privileges to create computer-derived objects to exploit the system through LDAP Add calls that enable overly permissive access to the securityDescriptor attribute. Additionally, creators and owners can modify security-sensitive attributes after creating an account, which can be leveraged for privilege elevation. The vulnerability received a CVSS v3.1 base score of 8.8 (HIGH) from NVD with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while Microsoft assessed it at 7.5 (HIGH) with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability can be exploited to perform elevation of privilege attacks in certain scenarios. It affects the security of Active Directory and LDS installations by potentially allowing unauthorized modifications to security-sensitive attributes, which could compromise the overall security posture of the system (Microsoft Support).

Microsoft has implemented a two-phase mitigation approach. The initial deployment phase includes additional authorization verification when users without domain or LDS administrator rights attempt LDAP Add operations, and temporary removal of Implicit Owner privileges during security descriptor modifications. The system operates in Audit-By-Default mode initially, with options to enable Enforcement mode through the dSHeuristics attribute. Organizations should update all devices hosting Active Directory domain controller or LDS Server roles with the latest Windows updates and monitor Directory Service event logs for events 3044-3056 (Microsoft Support).