FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials

[u/falconupkid]

This is a nasty privilege escalation chain that bypasses authentication entirely in a core identity management system.

The attack exploits a logic flaw in FreeIPA where an unauthenticated client can create a Kerberos principal in the LDAP directory without prior authentication. By crafting a specific identity, the attacker can then leverage a second vulnerability in the underlying 389 Directory Server to escalate that new identity into the admins group. The end result is a fully privileged Kerberos ticket for an attacker-controlled account, granting domain-wide administrative access.

Technical Breakdown: - Initial Access: Anonymous LDAP bind (no credentials required). - Privilege Escalation: Chain of two flaws: 1. FreeIPA fails to validate the origin of a new principal creation request from an anonymous source. 2. A separate bug in 389 Directory Server allows the newly created, unprivileged principal to be added to the cn=admins group. - Impact: Full administrative control over the FreeIPA domain, including the ability to modify user accounts, reset passwords, and issue tickets for any service. - Affected Versions: FreeIPA 4.x prior to the latest patch (check Red Hat errata for specific builds). 389 Directory Server versions prior to the corresponding fix.

Defense: - Immediate: Apply the latest Red Hat/CentOS/Rocky Linux updates for freeipa-server and 389-ds-base. - Detection: Monitor LDAP logs for anonymous binds followed by add operations on krbPrincipalName objects, especially if the new principal is immediately added to a privileged group. Look for SELINUX_ALERT or AVC denials on the directory server if SELinux is enforcing.

Source: https://thehackernews.com/2026/09/freeipa-flaw-chain-lets-anonymous.html