Windows LSA Spoofing Vulnerability (CVE-2021-36942, PetitPotam) Technical Analysis and Mitigation Guide

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-36942) is an LSA (Local Security Authority) spoofing flaw within the LSARPC interface of Windows operating systems. Known publicly as 'PetitPotam', the root cause lies in the improper access control and lack of authentication validation when handling specific remote procedure calls via the MS-EFSR (Encrypting File System Remote Protocol). Attackers can abuse these unauthenticated APIs to force the target system to initiate outbound authentication requests.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker on the local network connects to the LSARPC named pipe (\\pipe\\lsarpc or \\pipe\\efsrpc) on a Domain Controller (DC). By invoking specific MS-EFSR methods, such as EfsRpcOpenFileRaw, and passing a UNC path pointing to an attacker-controlled machine (e.g., \\attacker-ip\share\file), the attacker forces the DC's machine account (DC$) to attempt NTLM authentication against the rogue listener. The attacker then captures this NTLM credential exchange and relays it to an administrative service that does not enforce NTLM signing—most commonly the Active Directory Certificate Services (AD CS) Web Enrollment endpoints—to obtain a high-privilege Kerberos Ticket Granting Ticket (TGT), resulting in complete domain compromise.

3. Infrastructure & Business Impact

As a critical vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a high EPSS score, this flaw represents an immediate threat to enterprise infrastructure. Successful exploitation bypasses traditional perimeter defenses and allows lateral movement and privilege escalation to Domain Admin within minutes. This can lead to catastrophic business disruption, deployment of enterprise-wide ransomware, and complete loss of data confidentiality and integrity.