Improper Authorization in FreeIPA - CVE-2024-2698

Detailed vulnerability description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to an error in ipadb_match_acl() within the initial implementation of MS-SFU by MIT Kerberos, which was missing a condition for granting the “forwardable” flag on S4U2Self tickets. This results in S4U2Proxy requests to be accepted regardless of the fact there is a matching service delegation rule or not.

Note, this vulnerability does not affect default FreeIPA deployments because the services which have delegation rules defined are on IPA servers themselves. Services having RBCD (resource-based constrained delegation) rules are not affected by this vulnerability either.

How to mitigate CVE-2024-2698

Sources

• https://bugzilla.redhat.com/show_bug.cgi?id=2270353
• https://www.freeipa.org/release-notes/4-12-1.html