FreeIPA Flaw Lets Anonymous Clients Create Admin Credentials

FreeIPA contains a vulnerability that lets a client who has never logged in create its own Kerberos identity within the directory and automatically join the administrators group, Red Hat reports. The system determines who may log in across a Linux domain and stores all identities in a 389 Directory Server database accessed via LDAP. To succeed, the attacker must also exploit a second weakness in that database software.

The Kerberos protocol used by FreeIPA relies on time‑based tickets that typically expire after about an hour. An attacker exploiting these flaws could gain persistent access even if their initial session is terminated before a password change occurs; similar issues have been documented with NTLM sessions in Windows NT environments. SQL injection attacks against vulnerable OpenLDAP installations worldwide have previously targeted LDAP queries, demonstrating how attackers can chain vulnerabilities.

A prior privilege escalation bug (CVE-2017-14657) in 389 Directory Server allowed root access through LDAP injection. Because Kerberos tickets can be extended with administrator privileges, credential persistence remains possible until they naturally expire. Many organizations use FreeIPA without realizing how crucial it is to keep both components patched and monitored diligently.

Security teams should verify whether they run version 4.6 or earlier, apply any available patches addressing the Kerberos identity creation issue, update their 389 Directory Server component, audit LDAP queries for anomalous account creations, and enforce strict role assignments so newly created identities cannot automatically inherit administrative rights unless explicitly granted by an administrator.¹