CVE-2024-20674Windows Kerberos security feature bypass, impersonate the KDC

What broke

Windows Kerberos let an unauthenticated attacker on the network impersonate the Kerberos server (security feature bypass). Machine-in-the-middle, no prior account. CVSS 8.8. Microsoft patched it on 9 January 2024.

Why it matters

If you can impersonate the KDC, you can issue tickets. That is domain identity, not a workstation bug. Read it as the start of the 2024-2026 Kerberos train: PAC validation, PKINIT, CheckSum, KerberLoss.

What to do

• Deploy January 2024 updates on DCs and on members that speak Kerberos.
• Prefer SMB signing and channel binding so a forged KDC conversation is harder to land.
• Watch for unexpected KDC referrals and TGT requests that do not match your DC inventory.

After you patch

Active Directory compromise is not contained by patching, because the artifacts an attacker creates outlive the vulnerability.

• Rotate the krbtgt account twice, with the replication interval between rotations, if there is any indication of ticket forgery. One rotation is not enough.
• Audit AD CS certificate templates for enrolment and enrollee-supplied-subject permissions, which are the most common escalation path left behind. See certificate lifecycle.
• Review privileged group membership and delegation rights (Domain Admins, DnsAdmins, constrained and resource-based constrained delegation) for changes during the window.
• Hunt for tickets with anomalous lifetimes or encryption types, and for authentications to services that identity never touches.
• Treat any issued certificate as a durable credential: revoking a user's password does not revoke a certificate that authenticates as them. See privilege escalation and lateral movement.

Sources

• NVD: CVE-2024-20674
• Microsoft January 2024 Patch Tuesday