CVE-2017-12173

What it actually does

The sysdb_search_user_by_upn_res() function fails to sanitize input when querying the local cache, permitting injection that allows retrieval of cached password hashes by authenticated users.

Why it matters to the business

In centralized login environments, attackers can obtain password hashes leading to credential theft, offline cracking, and broader account compromise across the authentication infrastructure.

How an attack unfolds

An authenticated attacker supplies a crafted UPN query that exploits unsanitized input in the cache search function, causing the service to return the locally cached password hash for the targeted user.

How to fix it

Upgrade sssd/sssd to the version containing commit 2de0072db40ce90c9d376af38245cd1e0c9fa6ea.

How to confirm the fix worked

Confirm the installed sssd package or source revision includes commit 2de0072db40ce90c9d376af38245cd1e0c9fa6ea and test that cache queries no longer permit injection.

Typical attack path

1. Obtain valid authentication to the affected system or service
2. Craft a malicious request targeting sysdb_search_user_by_upn_res()
3. Inject payload via the unsanitized UPN parameter
4. Extract cached password hash from the query response

How to detect it

Inspect sssd logs and cache access records for unexpected or malformed search queries that target user UPN lookups outside normal operation.

What your security team should do

• Apply the fixed commit or later release immediately on all affected systems
• Audit local credential caching policies to reduce stored hash exposure
• Review authentication logs for anomalous cache query patterns