CVE-2023-5455

What it actually does

Cross-site request forgery in the ipa/session/login_password endpoint allows forged requests to perform actions as an authenticated user on certain HTTP endpoints without CSRF tokens or origin checks.

Why it matters to the business

Attackers could perform unauthorized configuration changes or actions within the identity management system after tricking users, potentially leading to loss of control over user accounts and system integrity.

How an attack unfolds

An attacker creates a malicious page that submits a request to the vulnerable login endpoint; the victim is tricked into visiting the page, authenticates to FreeIPA, and the forged request executes actions as that user without reflecting existing session cookies.

How to fix it

Upgrade FreeIPA to a build containing commit 9c617675d6676fcdb0e9d67fed6bb801e0066bfe or later to enforce CSRF protection on the affected endpoints.

How to confirm the fix worked

Confirm the fix commit is present in the source tree, verify updated packages, and test that the login_password endpoint now rejects cross-origin requests lacking proper protections.

Typical attack path

1. Attacker crafts a web page containing a form targeting the login_password endpoint
2. Victim is lured to the malicious page and initiates authentication to FreeIPA
3. Forged request is submitted during or after authentication to perform actions as the victim

How to detect it

Inspect web server and application logs for POST requests to the login_password endpoint that originate from unexpected external referrers or lack standard headers; correlate with subsequent administrative actions performed by the same user session.

• /ipa/session/login_password
• POST requests with external or mismatched Origin/Referer headers to the login endpoint

What your security team should do

• Apply the patched version containing the referenced commit as soon as possible
• Review authentication and session logs for suspicious POST activity to the login endpoint
• Consider additional web application firewall rules to block cross-origin requests to identity endpoints