CVE-2024-49019 (“EKUwu” — AD CS V1 Application Policy)

An AD CS flaw (the “ESC15” / “EKUwu”). Version-1 certificate templates (e.g. WebServer, User) let the requester specify arbitrary Application Policies — an OID set that, on V1 templates, wasn’t locked down the way pKIExtendedKeyUsage is on V2+. An attacker with enrollment rights on a V1 template can attach the Client Authentication (or Certificate Request Agent) application policy to their cert and get a cert that AD accepts for client auth / PKINIT — even though the template wasn’t meant to issue client-auth certs.

The chain (per ad-cs-esc-attacks ESC15)

1. Enrollment rights on a default V1 template (WebServer, User).
2. Request a cert with a forged application policy:

   certipy req -u user@domain.com -p pass -ca CA -template WebServer \
     -application-policies 'Client Authentication' -upn administrator@domain.com

3. Authenticate with the cert (PKINIT → TGT as the UPN) → domain dominance, or chain the Certificate Request Agent policy into ESC3 (on-behalf-of a privileged user).

Why it’s powerful

• No template rewrite — unlike ESC1/ESC4, you don’t need to change the template; the default V1 template is vulnerable as-shipped.
• Bypasses the EKU check — the cert carries a client-auth application policy even though the template’s pKIExtendedKeyUsage doesn’t advertise it.
• Wide surface — most domains still have the default V1 templates enabled.

Detection / mitigation

• AD CS — a cert issued from a V1 template carrying a client-auth application policy (the EKUwu tell).
• 4768 PKINIT — the resulting cert-based TGT request.
• Disable V1 templates (or the requester-specifiable application policy) — the primary mitigation; patch per the vendor guidance.
• Audit which V1 templates are enabled + who can enroll (certipy find).

Links

• ad-cs-esc-attacks — the ESC15 entry this CVE underpins
• esc8-ntlm-relay-adcs — the related AD CS → DCSync chain
• dcsync — the end-goal a client-auth cert often unlocks
• pkinit-unpac-the-hash — the cert → PKINIT → NT hash path
• certipy — the tooling (-application-policies)
• shadow-credentials — the related cert/key-trust abuse

References

• Microsoft: CVE-2024-49019
• SpecterOps / ired.team: ESC15 / EKUwu
• ad-cs-esc-attacks (this wiki)