CVE-2023-5455: Ipa: invalid csrf protection
A Cross-site request forgery vulnerability exists in ipa/session/loginpassword in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.
Other sources
FreeIPA is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed HTTP request to perform unauthorized actions. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.
— IBM
IPA uses the HTTP Referer header to prevent CSRF attacks but it is not applied universally. Notably, the URI ipa/session/loginpassword is not protected.
A third party may trick a valid user into leaving their credentials into a form and then steal a resulting cookie from a redirect to the freeipa login page.
This affects all supported versions of IPA.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-5455?
The severity of CVE-2023-5455 is classified as high due to its potential impact on user confidentiality and system integrity.
How do I fix CVE-2023-5455?
To fix CVE-2023-5455, users should upgrade to the latest version of the affected FreeIPA software.
Which versions of FreeIPA are affected by CVE-2023-5455?
CVE-2023-5455 affects all supported versions of FreeIPA prior to the fixed releases.
What type of vulnerability is CVE-2023-5455?
CVE-2023-5455 is a Cross-Site Request Forgery (CSRF) vulnerability.
What can attackers achieve with CVE-2023-5455?
Attackers can exploit CVE-2023-5455 to perform actions on behalf of a user, leading to potential unauthorized access and data manipulation.