CVE-2024-3183

What it actually does

Allows an attacker who compromises one principal to obtain TGS tickets encrypted directly with target principals' keys (derived from password hash plus per-principal salt) and perform offline brute-force attacks to recover those passwords.

Why it matters to the business

A single credential compromise can expose many additional accounts, enabling lateral movement, privilege escalation, and unauthorized access to identity-managed resources across the environment.

How an attack unfolds

After obtaining access to one user principal, the attacker requests TGS tickets for other principals; the tickets are captured, combined with publicly obtainable salts, and cracked offline to recover the target principals' passwords.

How to fix it

Upgrade FreeIPA to a version that ensures the ticket inside a TGS-REQ is also protected by the client session key; apply the fix referenced in commit d76bcaaaf0734aaf49a680f94ea9d4d22a602e70 or later.

How to confirm the fix worked

Confirm the deployed FreeIPA version contains the referenced commit, review Kerberos ticket encryption behavior in test environments, and verify that session-key protection is applied to the inner ticket.

Typical attack path

1. Compromise at least one user principal
2. Issue Kerberos TGS-REQs for arbitrary target principals
3. Capture the resulting tickets encrypted under the target principals' keys
4. Obtain per-principal salts and run offline brute-force or dictionary attacks to recover passwords

How to detect it

Review Kerberos KDC logs for unusual volumes or patterns of TGS-REQs from a single client to many different principals; correlate with subsequent successful authentications using previously unused accounts.

What your security team should do

• Prioritize patching all FreeIPA servers before the CISA remediation window if applicable
• Audit recent Kerberos ticket requests for anomalous patterns
• Enforce strong, unique passwords and enable additional factors where possible
• Monitor EPSS trend and any emerging exploit maturity indicators