FreeIPA REST API Privilege Escalation: Bypass Domain Restrictions to Modify Custom Roles

Vulnerability Overview Vulnerability Title: REST authorization: A credential confined to named domains could rewrite a custom role that accounts in other domains hold, and create custom roles and delete any that no account holds (6.3.4–6.3.6) Vulnerability Description: This vulnerability allows credentials restricted to specific named domains or server aliases to create, overwrite, or delete custom roles via the REST API. Attackers can create custom roles and delete any roles not held by any account. If a credential is restricted to a specific domain, it cannot delete roles held by accounts within that domain; however, it can bypass this restriction by creating a new role and deleting the old one. This vulnerability affects versions 6.3.4 through 6.3.6. Scope of Impact: Affected Versions: 6.3.4–6.3.6 Affected Components: Role management functionality in the REST API Impact Scenario: When credentials are restricted to specific named domains or servers, attackers can exploit this vulnerability to create, overwrite, or delete custom roles, thereby escalating privileges or compromising system security. Remediation: Fixed Version: 6.3.7 and later Fix Details: Corrected the permission validation logic for role management in the REST API, ensuring that credentials restricted to specific domains cannot create, overwrite, or delete custom roles. POC or Exploit Code: No specific POC or exploit code is provided in the page. Additional Information: Discovery Date: October 26, 2018 CVE ID: CVE-882 Status: Done Assigned To: Not specified Labels: Security Severity: 6.37 Iteration: Not specified Health Status: Not specified Time Tracking: Not specified Participants: 1 person

Goal Reached Thanks to every supporter — we hit 100%!

FreeIPA REST API Privilege Escalation: Bypass Domain Restrictions to Modify Custom Roles