REDHAT-BUG-2519523: High severity FreeIPA FreeIPA vulnerability
FreeIPA's certprofileimport.precallback (ipaserver/plugins/certprofile.py) only extracts and validates the profileId field from an uploaded certificate profile; the remainder of the profile configuration is passed through unvalidated to Dogtag. Dogtag's ExternalProcessConstraint (base/ca/src/main/java/com/netscape/cms/profile/constraint/ExternalProcessConstraint.java) executes a configured binary with request-derived environment variables, giving a user who can import certificate profiles (a CA-Administrator-equivalent privilege) code execution as pkiuser.
Independently reproduced against a stock freeipa/freeipa-server:almalinux-10 (FreeIPA 4.13.1) install, using an administrator credential obtained via the companion FreeIPA takeover flaw: the certprofile-import -> ExternalProcessConstraint chain executed attacker-controlled commands. In the reference container, a further SSSD-cache-forging + ksu misconfiguration escalated this to full root — confirmed via a random-token file write, then read back through an independent channel to rule out fabricated output. Whether the root escalation applies to a genuine RHEL RPM-packaged IdM/PKI install (as opposed to being specific to the community container's SSSD/ksu configuration) has not yet been independently confirmed and needs follow-up before finalizing severity.
This requires an already-authenticated CA-Administrator-equivalent account — it is not reachable anonymously on its own. Identified as part of the PSIRTSUPT-21812 investigation; see linked ticket for reproduction evidence.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker needs permission to import certificate profiles, described as CA-Administrator-equivalent privilege. The reproduced attack used an administrator credential obtained through a separate FreeIPA takeover flaw.
What code execution level was demonstrated?
The certprofile-import to ExternalProcessConstraint chain demonstrated execution of attacker-controlled commands as the pkiuser account. A subsequent escalation to root was demonstrated only in the reference container using SSSD-cache forging and a ksu misconfiguration.
Are standard installations affected?
The command-execution chain was independently reproduced on a stock freeipa/freeipa-server:almalinux-10 container running FreeIPA 4.13.1. The available information does not establish whether the root escalation applies to a genuine RHEL RPM-packaged IdM/PKI installation.
What configuration enables the command execution?
FreeIPA validates only the uploaded profileId during certificate-profile import and passes the remaining profile configuration to Dogtag. A crafted profile can configure Dogtag's ExternalProcessConstraint to execute a binary with request-derived environment variables.