CVE-2025-4404: Freeipa: idm: privilege escalation from host to domain admin in freeipa
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the krbCanonicalName for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.
Other sources
The lack of verification for the uniqueness of the LDAP attribute krbCanonicalName in FreeIPA may lead to privilege escalation from host to domain admin.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4404?
CVE-2025-4404 has been rated as a medium severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2025-4404?
To fix CVE-2025-4404, upgrade your FreeIPA installation to the latest patched version where the vulnerability has been addressed.
Who is affected by CVE-2025-4404?
CVE-2025-4404 affects all versions of the FreeIPA project that do not validate the uniqueness of the 'krbCanonicalName' for the admin account.
What impact does CVE-2025-4404 have on systems?
CVE-2025-4404 could allow an attacker to escalate privileges from a host to the domain level, compromising the security of the affected systems.
Is there a workaround for CVE-2025-4404 if I cannot update immediately?
A potential workaround for CVE-2025-4404 is to manually enforce unique 'krbCanonicalName' entries for services, though this is not a complete solution.