REDHAT-BUG-2519522: FreeIPA vulnerability
An unauthenticated LDAP client (anonymous bind or SASL ANONYMOUS) can create a self-managed OTP token entry with empty ipaTokenOwner/managedBy attributes, which satisfy 389 Directory Server's SELFDN ACI evaluator against the anonymous bind's own empty DN (see companion 389-ds flaw for that underlying defect). FreeIPA's self-managed-token ACI (install/share/default-aci.ldif) does not restrict which other attributes may be added, allowing the client to inject a Kerberos principal and password. Combined with a canonical-principal mismatch and, on older releases, a password-expiration-bypass, this produces genuine, reusable FreeIPA administrator Kerberos credentials. On SID-enabled deployments, the anonymously-readable ipaNTSecurityIdentifier attribute lets the attacker also obtain a PAC-bearing TGT, extending access to HTTP/Dogtag.
Independently reproduced twice against a stock, unmodified freeipa/freeipa-server:almalinux-10 (FreeIPA 4.13.1) install — most recently from a client with zero prior access (no ticket, no local presence, network reachability only). Verified beyond the PoC's own output via klist -f, ldapwhoami -Y GSSAPI (returned genuine admin DN), ldapcompare (confirmed cn=admins membership), and a real admin-only write/delete (ipa user-add / ipa user-del).
Reported by Gia Bui (Calif.io) via PSIRTSUPT-21812; see linked ticket for full technical writeup, reporter PoC, and reproduction logs.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this?
The issue was reproduced from a client with no prior access: no Kerberos ticket, no local presence, and only network reachability to the target. The attacker uses an unauthenticated LDAP connection through an anonymous bind or SASL ANONYMOUS.
Is a default deployment affected?
The issue was independently reproduced against a stock, unmodified freeipa/freeipa-server:almalinux-10 installation running FreeIPA 4.13.1. The vulnerable self-managed-token ACI is identified as install/share/default-aci.ldif.
What level of access can successful exploitation provide?
Successful exploitation can create genuine, reusable FreeIPA administrator Kerberos credentials. Validation included a Kerberos ticket listing, GSSAPI LDAP authentication returning the genuine administrator DN, and LDAP comparison checks.
Does SID support change the impact?
Yes. On SID-enabled deployments, the anonymously readable ipaNTSecurityIdentifier attribute can allow the attacker to obtain a PAC-bearing TGT, extending access to HTTP/Dogtag.