SSSD LDAP sudo provider privilege escalation vulnerability

Compliance Impact

The vulnerability allows an authenticated attacker with write access to inject sudoRole objects granting root-level sudo privileges on all SSSD-enrolled hosts. This escalation of privileges can lead to unauthorized access and control over sensitive systems and data.

Such unauthorized privilege escalation and potential data exposure can negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require strict access controls and protection of sensitive information.

Useful 0 Not Useful 0

Impact Analysis

If you are using SSSD with the sudo LDAP provider and have not explicitly set the ldap_sudo_search_base option, an attacker with write access to any LDAP subtree can escalate their privileges.

This means the attacker could gain root-level sudo privileges on all systems enrolled with SSSD, potentially leading to full system compromise, unauthorized access, and control over critical resources.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you should check the SSSD configuration for the presence and value of the ldap_sudo_search_base option. If this option is not explicitly set, the system is vulnerable because SSSD will search the entire LDAP directory tree for sudoRole objects.

You can inspect the SSSD configuration file, typically located at /etc/sssd/sssd.conf, using commands like:

• grep -i ldap_sudo_search_base /etc/sssd/sssd.conf
• grep -i sudo_provider /etc/sssd/sssd.conf

Additionally, verify if sudo_provider is set to ldap or ad, as these configurations are affected by the vulnerability.

To detect unauthorized sudoRole objects injected by an attacker, you may need to audit your LDAP directory for unexpected sudoRole entries, especially those granting root-level privileges.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to explicitly configure the ldap_sudo_search_base option in the SSSD configuration to limit the LDAP subtree that SSSD searches for sudoRole objects.

By setting ldap_sudo_search_base to a specific, restricted LDAP subtree, you prevent SSSD from searching the entire LDAP directory tree, thereby reducing the risk of an attacker injecting malicious sudoRole objects.

Also, review and restrict write permissions on your LDAP directory to prevent unauthorized users from creating or modifying sudoRole objects.

If your sudo_provider is set to ipa, this vulnerability does not apply, so consider using ipa if feasible.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD performs a subtree search across the entire LDAP directory for sudoRole objects.

Because of this, an authenticated attacker who has write access to any part of the LDAP directory can inject a sudoRole object. This injected object can grant root-level sudo privileges on all hosts that use SSSD for sudo authorization.

Useful 0 Not Useful 0