SSSD Entra ID Identity Provider OData Query Injection

Executive Summary

This vulnerability is in SSSD when using the Entra ID identity provider for Microsoft Azure Active Directory lookups. It allows a low-privileged local attacker to inject single quotes into name-based lookups, manipulating OData queries sent to Microsoft Graph. This bypasses query constraints, broadening returned directory objects and causing unintended data exposure or excessive processing.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor SSSD logs for unusual OData query patterns or excessive data retrievals from Microsoft Graph. Check for name-based lookups containing single quotes in logs like /var/log/sssd/*.log. Look for queries with altered filter conditions such as startsWith(userPrincipalName,'a') or userPrincipalName ne ('@').

Commands to inspect: grep -r "entra_id_lookup" /var/log/sssd/ 2>/dev/null; journalctl -u sssd --no-pager | grep -i "odata\|filter". Ensure no untrusted users have access to trigger IdP-backed lookups.

Useful 0 Not Useful 0

Impact Analysis

The impact includes information disclosure by retrieving unintended directory objects and a Denial of Service through excessive processing and cache population. Exploitation requires local access and does not allow unauthorized modifications or privilege escalation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data exposure, potentially violating GDPR or HIPAA compliance by disclosing sensitive directory objects. The risk depends on the permissions granted to the Graph client and the sensitivity of exposed data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict local users from triggering Entra ID identity provider lookups. Disable the Entra ID IdP in SSSD configuration if not required. Review and minimize Microsoft Graph application permissions to reduce data exposure. Monitor system performance for unusual cache growth or high CPU usage.

Update SSSD to the latest patched version if available. Consider disabling name-based lookups via NSS for untrusted users until a fix is applied. Audit all SSSD configurations for the Entra ID IdP and remove or secure them.

Useful 0 Not Useful 0