CVE-2026-73197: Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

AIONLYREPORT package: ipa-4.13.1-3.el10 ------ Summary: Unauthenticated DoS in /ipa/migration/migration.py via Unbounded Request Body Read: oversized unauthenticated form POST requests can force the migration handler to read attacker-controlled request bodies fully into memory, causing worker memory pressure and service degradation. Requirements to exploit: Network access to /ipa/migration/migration.py and the ability to send large POST requests with application/x-www-form-urlencoded; no authentication is required. Deployments that already enforce strict front-end request-body limits or do not expose this endpoint materially reduce exploitability. Component affected: ipa-4.13.1-3.el10, install/migration/migration.py, Apache /ipa/migration WSGI endpoint, application() Version affected: ipa-4.13.1-3.el10 Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - 5.3 (MEDIUM) AV:N - The issue is reachable over HTTP(S) through the exposed migration endpoint. AC:L - Exploitation requires only sending an oversized POST body; no race or special precondition was established. PR:N - The endpoint is configured to allow unauthenticated access. UI:N - No user interaction is required. S:U - The impact is limited to the vulnerable service's own security scope. C:N - No confidentiality impact was established. I:N - No integrity impact was established. A:L - The demonstrated effect is memory pressure and service degradation in affected workers, rather than full system compromise. Impact: Important. Red Hat guidance classifies flaws that allow remote users to cause a denial of service as Important. This issue is a remote, unauthenticated availability flaw against a web-facing endpoint in the shipped configuration. It is not Critical because no code execution or confidentiality/integrity impact was established, and deployment-specific body-size limits can reduce exploitability. Embargo: no Reason: This is an availability-only issue with straightforward mitigations, including disabling the migration endpoint where unused or enforcing conservative request-body limits at the HTTP front end. Acknowledgement: Aisle Research Vulnerability Details: The password migration WSGI handler accepts form-encoded POST requests, trusts CONTENTLENGTH, and reads that many bytes from wsgi.input into memory before validating the request contents. There is no application-level upper bound before the read: python install/migration/migration.py try: length = int(environ.get("CONTENTLENGTH")) except (ValueError, TypeError): return badrequest(startresponse)

querystring = environ["wsgi.input"].read(length).decode("utf-8") The shipped Apache template exposes the migration directory without authentication: apache install/share/ipa.conf.template Alias /ipa/migration "/usr/share/ipa/migration" <Directory "/usr/share/ipa/migration"> AllowOverride None Satisfy Any Require all granted Options ExecCGI AddHandler wsgi-script .py </Directory>

In deployments using this endpoint, an unauthenticated client can submit oversized request bodies and force a WSGI worker to allocate attacker-controlled data in memory. This can increase RSS, slow request handling, and in some deployments lead to worker recycling or service disruption. No direct confidentiality or integrity impact was established from the available evidence. No request-body cap was identified in the shipped template configuration, although external reverse proxies or HTTP server hardening may reduce or block exploitability. Steps to reproduce: 1. Deploy ipa-4.13.1-3.el10 with the shipped Apache configuration that exposes /ipa/migration/migration.py. 2. Confirm the endpoint is reachable without authentication: bash curl -k -i https://<host>/ipa/migration/migration.py -X POST -H 'Content-Type: application/x-www-form-urlencoded' --data 'username=a&password=b' 3. Send an oversized unauthenticated POST body: bash python3 - <<'PY' import requests u='https://<host>/ipa/migration/migration.py' d='username=a&password='+'A'(20010241024) print(requests.post(u,data=d,headers={'Content-Type':'application/x-www-form-urlencoded'},verify=False,timeout=120).statuscode) PY 4. Repeat from multiple clients or in a loop. 5. Observe httpd/WSGI worker RSS growth and service degradation, including higher memory pressure, slower responses, or worker recycling/failure. Mitigation: If the migration endpoint is not needed, disable or unpublish /ipa/migration. Otherwise, enforce a conservative request-body limit for this path at the HTTP front end so oversized POST bodies are rejected before they reach the WSGI script. Proposed Fix: Reject negative or excessively large request bodies before reading from wsgi.input. diff diff --git a/install/migration/migration.py b/install/migration/migration.py index 0000000..0000000 100644 — a/install/migration/migration.py +++ b/install/migration/migration.py @@ -31,6 +31,8 @@ from ipapython import ipaldap from ipalib import errors, createapi logger = logging.getLogger(os.path.basename(file)) +MAXREQUESTBODY = 1024 1024 # 1 MiB, sufficient for username/password form + @@ -83,6 +85,10 @@ def application(environ, startresponse): try: length = int(environ.get("CONTENTLENGTH")) except (ValueError, TypeError): + return badrequest(startresponse) + + if length < 0 or length > MAXREQUESTBODY: return badrequest(startresponse) querystring = environ["wsgi.input"].read(length).decode("utf-8") ------ This report was generated using AI technology. Always review AI-generated content prior to use

— Red Hat