SSSD LDAP Account Expiration Bypass via Zero Value

Executive Summary

This vulnerability is an access control bypass in SSSD where accounts configured with shadowExpire=0 bypass expiration checks. SSSD fails to treat zero as an expired account, allowing users with valid credentials to authenticate even after the account was intended to be deactivated.

Useful 0 Not Useful 0

Detection Guidance

Check SSSD configuration for LDAP shadow expiration settings. Verify if `access_provider = ldap`, `ldap_access_order` includes `expire`, and `ldap_account_expire_policy = shadow` are set. Inspect LDAP accounts for `shadowExpire=0` values that should be expired. Use commands like `sssd --genconf` to review configuration and `ldapsearch` to query shadow attributes.

Useful 0 Not Useful 0

Impact Analysis

It allows unauthorized access to persist for accounts that should be expired. Attackers with valid credentials for expired accounts can bypass access controls and maintain system access, potentially leading to data breaches or unauthorized actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements that mandate timely deactivation of expired accounts. It undermines access control policies, potentially leading to unauthorized data access and non-compliance with data protection regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Avoid using `shadowExpire=0` for account expiration. Enforce directory-side expiration controls instead. Update SSSD to a patched version if available. Temporarily disable LDAP shadow expiration enforcement if immediate mitigation is required. Monitor authentication logs for unauthorized access attempts.

Useful 0 Not Useful 0