FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials

Red Hat has disclosed a critical vulnerability chain affecting FreeIPA and 389 Directory Server, the identity management and LDAP directory components used in many Linux enterprise environments. According to a report by The Hacker News, the flaw allows a client that has never logged in to create a Kerberos identity in the directory and then add that identity to the administrators group, resulting in the creation of reusable administrator credentials.

FreeIPA is the central system that manages identities and access policies across a Linux domain, storing all user and group information in a 389 Directory Server database accessed via LDAP. The attack requires chaining two distinct flaws: one in FreeIPA that permits the creation of arbitrary Kerberos identities, and another in 389 Directory Server that likely bypasses access controls. No authentication is required, making the attack remotely exploitable by any unauthenticated client.

The impact is severe: an attacker who successfully exploits this chain can gain full administrative control over the identity management system, potentially leading to unauthorized access to all systems and services that rely on FreeIPA for authentication and authorization. This could result in data breaches, service disruption, and lateral movement across the entire domain.

Red Hat has released a security advisory addressing both components. Specific CVE identifiers were not listed in the initial report, and technical details of the attack chain remain limited. Organizations using FreeIPA with 389 Directory Server, particularly those on Red Hat Enterprise Linux and derivatives, are strongly advised to apply the available patches as soon as possible.

While no active exploitation has been reported yet, the severity of the issue and the ease of exploitation (requiring no prior access) make it a high-priority concern for security teams. Administrators should also review their directory configurations for any suspicious entries or unauthorized administrative accounts.

This advisory underscores the importance of promptly patching identity infrastructure, as such systems are prime targets for attackers seeking to establish persistent access within an organization.