An authenticated vulnerability in Red Hat FreeIPA allows low-privileged users to access sensitive environment variables and cause service disruptions.

The vulnerability is an eval injection flaw (CWE-95) triggered by insufficient validation of the --organization and --base-url parameters. This allows any authenticated IPA principal, regardless of their specific role or privilege level, to execute code that reads server environment variables and exhausts system memory.

The ability for any authenticated user to read environment variables poses a significant risk, as these variables often contain sensitive configuration data, API keys, or database credentials. Furthermore, the potential for memory exhaustion leading to a denial of service can disrupt critical identity management infrastructure. With a CVSS score of 8.1, this vulnerability represents a high-severity threat to organizational availability and data confidentiality.

Immediate Action: Apply security updates provided by Red Hat as soon as they become available for your specific RHEL version. Monitor the Red Hat security advisory page for the release of a patched package.

Proactive Monitoring: Review FreeIPA access logs for unusual or repetitive calls to the idp-add command, particularly those containing irregular character sequences in the organization or base-url fields.

Compensating Controls: Limit access to the idp-add command by enforcing strict identity management policies and restricting administrative command execution to authorized service accounts only.

Public Exploit Available: False

Given the potential for unauthorized data access and service disruption, administrators should prioritize the remediation of this flaw upon the release of vendor patches. Ensure that all IPA principals are managed with the principle of least privilege to minimize the potential impact of an authenticated attacker exploiting this vulnerability.