CVE-2021-36942

Windows LSA Spoofing Vulnerability (CVE-2021-36942)

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2021-36942 is a Windows Local Security Authority (LSA) spoofing vulnerability affecting multiple Windows Server versions. The vulnerability is rated HIGH severity under CVSS v3.1 with a base score of 7.5, and MEDIUM under CVSS v2 with a score of 5.0. With an EPSS score of 0.66023 (99.18th percentile), the probability of active exploitation is exceptionally high. The vulnerability has been actively exploited in the wild since November 2021 and is listed in CISA's Known Exploited Vulnerabilities catalog.

Background

The Local Security Authority (LSA) is a critical Windows subsystem responsible for enforcing security policies and managing authentication. Spoofing vulnerabilities in LSA-related components can allow attackers to manipulate authentication processes between systems. This vulnerability class targets the trust relationships that Windows Servers rely upon for secure communication.

Root Cause

The root cause is an LSA spoofing condition where authentication requests are not properly validated. While the specific CWE identifier is not documented in available records, the underlying weakness relates to insufficient verification of authentication protocol integrity, allowing an unauthenticated remote attacker to interfere with LSA operations. The vulnerability can be exploited without authentication, user interaction, or local access.

Impact

Under CVSS v3.1, the vulnerability scores 7.5 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N:

• Attack Vector (AV): Network — exploitable remotely
• Attack Complexity (AC): Low — no special conditions required
• Privileges Required (PR): None — no valid credentials needed
• User Interaction (UI): None — no user action required
• Scope (S): Unchanged — impact limited to the vulnerable component
• Confidentiality (C): High — significant information disclosure
• Integrity (I): None
• Availability (A): None

The CVSS v2 vector AV:N/AC:L/Au:N/C:N/I:P/A:N reflects partial integrity impact under the older scoring model, while CVSS v3.1 emphasizes the confidentiality impact.

Exploitation Walkthrough

Ethics Notice: The following description is provided for defensive awareness only. No weaponized exploit code is included.

An attacker with network access to a vulnerable Windows Server can exploit this vulnerability through the following conceptual steps:

1. Target Identification: Locate Windows Servers running affected versions that expose LSA interfaces.
2. Spoofing Attempt: Send a crafted request to the LSA interface designed to trigger an unintended authentication or trust operation.
3. Credential Exposure: The spoofed authentication attempt may expose credentials or authentication material to the attacker.
4. Lateral Movement: Obtained credentials or authentication material may be used to access additional systems.

This attack chain requires no valid credentials, user interaction, or local access, making it particularly severe in enterprise environments.

Affected and Patched Versions

The following Windows Server versions are confirmed vulnerable:

• Windows Server 2004
• Windows Server 2008 (SP2)
• Windows Server 2008 R2 (SP1, x64)
• Windows Server 2012
• Windows Server 2012 R2
• Windows Server 2016
• Windows Server 2019
• Windows Server 20H2

Microsoft released security updates to address this vulnerability. Organizations should apply the relevant patches through Microsoft Update or Windows Server Update Services (WSUS). End-of-life versions require migration planning or extended support agreements.

Remediation

1. Apply Security Updates: Install the relevant Microsoft security updates for all affected Windows Server versions.
2. Enable Authentication Protections: Configure Extended Protection for Authentication (EPA) where supported to reduce relay attack surface.
3. Require SMB Signing: Enforce SMB signing to prevent tampering with authentication negotiations.
4. Network Segmentation: Segment networks to restrict lateral movement and limit exposure of LSA interfaces.
5. Disable Legacy Protocols: Transition away from legacy authentication protocols where possible.
6. Account Tiering: Implement credential tiering to limit the impact of compromised credentials.

Detection

Security teams should monitor for:

• Unusual authentication events from unexpected source IPs
• SMB and RPC traffic patterns targeting LSA interfaces from non-administrative hosts
• NTLM authentication anomalies where Kerberos is expected
• Event log patterns indicating forced authentication attempts

Assessment

CVE-2021-36942 represents a critical risk to Windows Server environments due to its high EPSS score (0.66023), low exploitation complexity, and confirmed active exploitation since November 2021. The vulnerability is tracked in CISA's Known Exploited Vulnerabilities catalog and the European Union vulnerability database (EUVD-2021-23518).

Key lessons:

1. Patch velocity matters: The short window between disclosure and active exploitation demonstrates the need for rapid patch deployment.
2. Authentication boundaries require continuous hardening: Core authentication subsystems like LSA remain high-value targets and require ongoing defensive investment.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36942
• https://www.kb.cert.org/vuls/id/405600
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36942