REDHAT-BUG-2523356: Input Validation
A flaw was found in FreeIPA's idp-add command. ipapython.ipautil.templatestr() evaluates any 'eval(...)' token found in a post-substitution string using Python's eval(). ipaserver/plugins/idp.py passes the caller-supplied --organization and --base-url values (ipaidporg/ipaidpbaseurl), which have no input validation, into this function via provider templates (okta, keycloak, microsoft). The LDAPCreate command framework runs this evaluation inside precallback, before the LDAP access control check that restricts idp-add to the 'External IdP server Administrators' privilege is ever evaluated. As a result, any authenticated IPA principal, regardless of privilege level, can trigger this evaluation.
The regular expression that locates the eval(...) token forbids parentheses inside the evaluated expression, which prevents invoking any function and therefore prevents code execution. However, using parenthesis-free short-circuit boolean expressions, an attacker can distinguish, via the JSON-RPC error code returned by the server, whether a guessed condition is true, and combined with parenthesis-free star and dict-unpacking syntax, this allows systematic enumeration and extraction of the entire environment of the affected server process, with no prior knowledge of variable names required. Separately, a short expression exploiting Python's right-associative exponentiation operator reliably exhausts the affected process's available memory within seconds, providing a cheap, repeatable denial-of-service primitive.
Both primitives are reachable by any authenticated IPA principal, not only those holding the privilege the idp-add command is nominally restricted to.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure the caller-supplied --organization (ipaidporg) and --base-url (ipaidpbaseurl) values used by FreeIPA provider templates are strictly validated/escaped so they cannot inject an eval(...) token into ipapython.ipautil.template_str() evaluation.
FreeIPA idp-add / LDAPCreate eval handling (ipaserver/plugins/idp.py) --organization and --base-url input validation = validated/escaped (no eval-token injection) - Compensating control
Restrict access to the FreeIPA idp-add functionality so that only the 'External IdP server Administrators' privilege can reach the LDAPCreate pre_callback evaluation path (e.g., enforce authorization before any evaluation occurs).
- Compensating control
Add compensating throttling/rate limiting for the JSON-RPC endpoint that triggers idp-add evaluation and for the specific request patterns that exhaust memory (e.g., limit repeated calls from a single authenticated IPA principal/session) to reduce DoS impact.
Event History
Frequently Asked Questions
Who can trigger the vulnerable processing?
Any authenticated IPA principal can trigger it, regardless of privilege level. The command's check for the External IdP server Administrators privilege occurs only after the evaluation has already run.
What attacker-controlled inputs reach the evaluation path?
The caller-supplied --organization and --base-url values are passed into provider templates without input validation. The affected provider templates are okta, keycloak, and microsoft.
Does the issue permit direct Python code execution?
The described expression matcher forbids parentheses inside eval(...) expressions, preventing function invocation and therefore preventing code execution. It can still expose whether guessed conditions are true through differing JSON-RPC error codes, enabling systematic enumeration.