Mandiant Identifies Vulnerability in ADFS Certificate Management

Introduction to Ghost Certificates

Mandiant's research on the 'Golden SAML' technique has highlighted significant vulnerabilities in Microsoft identity management.

The discovery during a recent red team engagement showed that certain configurations lead to active ADFS signing keys being left exposed.

Mechanism of the Vulnerability

When AutoCertificateRollover is disabled, and certificates are rotated manually, old certificates can still exist in Machine DPAPI, creating a 'ghost' record.

This configuration is prevalent in enterprise environments, allowing adversaries to exploit it without triggering alarms.

Impact of the Exploit

By accessing the exposed signing keys, attackers can authenticate as any user to SAML-federated applications, bypassing MFA and identity controls.

The low visibility of this attack method due to its avoidance of direct interactions with monitored components enhances its threat level.

Recommendations for Mitigation

Organizations should ensure that AutoCertificateRollover is enabled and conduct regular audits of their ADFS configurations.

Mandiant provides a detailed blueprint for defending against exploitation of this vulnerability, urging awareness and proactive measures.