Description

Internal service information should not be stored in the source code, especially AD configurations, as it is obtained from the admon-chanel configuration file.

Impact

Use these insecure service configurations to gain access to the AD and collect all kinds of information that will be useful in later attacks, such as internal network architecture recognition or employee information.

Recommendation

Service configurations and credentials must be in protected environments.

Threat

Internal attacker with access to service configurations.

Expected Remediation Time

⏱️ 60 minutes.

Requirements

Fixes