How to remediate – Active Directory Certificate Services Web Enrollment Anonymous…

1. Introduction

The remote web server is a certificate enrollment server that anyone can access without credentials. This means an attacker could request certificates from your system, potentially breaking the chain of trust and allowing them to impersonate legitimate users or services. Systems running Microsoft Certificate Services with misconfigured web enrollment are usually affected. A successful exploit could compromise confidentiality, integrity, and availability.

2. Technical Explanation

• Root cause: Missing or incorrect authentication requirements for the Certificate Services Web Enrollment service.
• Exploit mechanism: An attacker sends a standard HTTP request to the web enrollment endpoint without credentials, and receives a certificate in return. For example, an attacker could use a tool like PowerShell’s Invoke-WebRequest to submit a certificate request.
• Scope: Microsoft Certificate Services running on Windows Server operating systems with Web Enrollment enabled are affected.

3. Detection and Assessment

You can confirm the vulnerability by checking if anonymous access is allowed for the web enrollment service. A thorough method involves reviewing the IIS configuration.

• Quick checks: Use PowerShell to check the authentication methods configured for the Certificate Services Web Enrollment virtual application in IIS.
• Scanning: Nessus plugin ID 139254 can detect this misconfiguration, but results should be verified manually.
• Logs and evidence: Check the IIS logs (typically located at %SystemDrive%inetpublogsLogFiles) for requests to the Certificate Services Web Enrollment endpoint without authentication information.

Get-WebConfigurationProperty -Filter system.webServer/security/authentication/anonymousAuthentication -Location "IIS:SitesCertificateServicesWebApp" | Select-Object Enabled

4. Solution / Remediation Steps

The solution is to edit the remote web server configuration to force authentication prior to accessing the certificate enrollment resource.

4.1 Preparation

• Dependencies: Access to the server running Microsoft Certificate Services and administrative privileges. Roll back by restoring the IIS configuration from the backup.
• Change window: A standard change window is recommended for production systems. Approval may be needed from security or infrastructure teams.

4.2 Implementation

1. Step 1: Open Internet Information Services (IIS) Manager.
2. Step 2: Expand the server node and select “Sites”.
3. Step 3: Select the site hosting the Certificate Services Web Enrollment application.
4. Step 4: Double-click “Authentication” in the Features View.
5. Step 5: Disable Anonymous Authentication by right-clicking it and selecting “Disable”.
6. Step 6: Ensure Windows Authentication is enabled.

4.3 Config or Code Example

Before

<system.webServer>
  <security>
    <authentication>
      <anonymousAuthentication enabled="true" />
      <windowsAuthentication enabled="false" />
    </authentication>
  </security>
</system.webServer>

After

<system.webServer>
  <security>
    <authentication>
      <anonymousAuthentication enabled="false" />
      <windowsAuthentication enabled="true" />
    </authentication>
  </security>
</system.webServer>

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue.

• Practice 1: Least privilege – limit the accounts that have access to sensitive services like Certificate Services.
• Practice 2: Secure defaults – configure new services with authentication enabled by default, rather than relying on insecure configurations.

4.5 Automation (Optional)

PowerShell can be used to automate this change.

# Disable Anonymous Authentication for Certificate Services Web App
Set-WebConfigurationProperty -Filter system.webServer/security/authentication/anonymousAuthentication -Location "IIS:SitesCertificateServicesWebApp" -Value Enabled="false"

5. Verification / Validation

Confirm the fix by checking that anonymous access is disabled and authentication is required for the web enrollment service.

• Post-fix check: Run the PowerShell command from Section 3 again. The output should show Enabled : False.
• Re-test: Attempt to request a certificate without providing credentials using a tool like PowerShell’s Invoke-WebRequest. You should receive an authentication error.
• Monitoring: Monitor IIS logs for failed authentication attempts to the Certificate Services Web Enrollment endpoint, which could indicate ongoing attacks or misconfigurations.

Get-WebConfigurationProperty -Filter system.webServer/security/authentication/anonymousAuthentication -Location "IIS:SitesCertificateServicesWebApp" | Select-Object Enabled

6. Preventive Measures and Monitoring

Update security baselines to prevent this issue from recurring.

• Baselines: Update your IIS security baseline or policy to enforce authentication for the Certificate Services Web Enrollment application. For example, a CIS control related to web server configuration.
• Pipelines: Include checks in CI/CD pipelines to validate that new servers are configured with secure defaults.
• Asset and patch process: Review configurations regularly during asset management or patching cycles.

7. Risks, Side Effects, and Roll Back

Disabling anonymous authentication may impact existing applications that rely on it (unlikely in this scenario). The roll back steps are to re-enable Anonymous Authentication.

• Roll back:
  1. Open IIS Manager.
  2. Navigate to the Certificate Services Web Enrollment application’s Authentication settings.
  3. Enable Anonymous Authentication.

8. References and Resources

Links only to sources that match this exact vulnerability.

• Vendor advisory or bulletin: Microsoft Certificate Enrollment Web Service Errors
• NVD or CVE entry: Not applicable for this specific misconfiguration.
• Product or platform documentation relevant to the fix: Configure Anonymous Authentication in IIS