SSSD LDAP Password Expiration Bypass via Early Rule Termination

Executive Summary

This vulnerability in SSSD occurs when password expiration warnings are checked before restrictive access rules in LDAP setups. An expired password warning incorrectly terminates rule evaluation early, treating the access request as successful. This allows a remote authenticated user with an expired password but using an alternative authentication method like SSH public key login to bypass access controls and gain unauthorized access.

Useful 0 Not Useful 0

Detection Guidance

Check SSSD configuration for the ldap_access_order setting. Look for pwd_expire_policy_warn placed before restrictive rules like filter, host, or rhost. Use commands like grep -r 'ldap_access_order' /etc/sssd/ to inspect configurations.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to protected systems even with an expired password. Attackers could bypass access restrictions and gain entry using alternative authentication methods. The impact includes potential confidentiality and integrity breaches, depending on the compromised system's role.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access, violating compliance requirements for access control and data protection in standards like GDPR and HIPAA. Unauthorized access may result in data breaches, non-compliance penalties, and reputational damage due to compromised confidentiality and integrity of sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Modify the ldap_access_order in SSSD config to place pwd_expire_policy_warn after restrictive rules or replace it with pwd_expire_policy_reject. Avoid placing pwd_expire_policy_warn before filter, host, or rhost entries.

Useful 0 Not Useful 0