Vulnerability in open source identity management system Free IPA could lead to XXE attacks

Jessica Haworth 18 August 2022 at 15:38 UTC

Attackers could ‘take full control of the infrastructure’, warn researchers

A vulnerability in Free IPA could lead to XML external entity (XXE) attacks, researchers have warned.

FreeIPA is a free and open source identity management system and is the upstream project of Red Hat Identity Management.

A flaw, tracked as CVE-2022-2414, was found in the package, a security advisory from Red Hat warns.

Read more of the latest news about security vulnerabilities

“Access to external entities when parsing XML documents can lead to XML external entity attacks.

“This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.”

The vulnerability, which has a severity rating of 7.5 (high), was discovered by researcher Egor Dimintrenko of security research team PT Swarm.

“In some cases, it allows attackers to read the Directory Manager password from the config of FreeIPA and take full control of the infrastructure,” PT Swarm commented.

It affects Red Hat Enterprise Linux 6-9 and Red Hat Certificate System 9 and 10.

The vulnerability has been patched by Red Hat in all versions apart from Linux 6, which is out of scope. There are no known mitigations available and Red Hat urges users to update.

The Daily Swig has reached out to PT Swarm for further comment and will update this article accordingly.

YOU MAY ALSO LIKE Secure Open Source Rewards program launched to help protect critical upstream software