CVE-2025-4404 — AI Deep Analysis Summary

🚨 **Essence**: Red Hat FreeIPA fails to verify the uniqueness of `krbCanonicalName`. 📉 **Consequences**: Attackers can steal REALM admin credentials and execute unauthorized management tasks.…

🛡️ **Root Cause**: CWE-1220. The core flaw is the **lack of validation** for the uniqueness of the `krbCanonicalName` attribute.…

🏢 **Affected**: Red Hat FreeIPA. Specifically, versions prior to the fix in RHSA-2025 advisories. The POC mentions **FreeIPA 4.12.4** as a vulnerable baseline where admin accounts lack proper `krbCanonicalName` values.

💀 **Attacker Capabilities**: With valid credentials, hackers can: 1️⃣ Obtain REALM administrator credentials. 2️⃣ Perform sensitive management tasks.…

🔐 **Exploitation Threshold**: **Medium-High**. Requires **PR:H** (High Privileges) initially. You need a valid domain computer account (e.g., `host/pc1.test.local`) to initiate the attack.…

🔓 **Public Exp?**: **YES**. POCs are available on GitHub (e.g., `Cyxow/CVE-2025-4404-POC`). The attack involves using `kinit` with a host keytab and modifying LDAP entries to inject malicious `krbCanonicalName` values.

🔍 **Self-Check**: 1️⃣ Check if your FreeIPA version is < the patched version. 2️⃣ Audit LDAP entries for missing or duplicate `krbCanonicalName` on admin accounts.…

✅ **Official Fix**: **YES**. Red Hat released security advisories: **RHSA-2025:9190**, **RHSA-2025:9184**, **RHSA-2025:9191**, and **RHSA-2025:9189**. Update immediately via Red Hat Network.

🚧 **No Patch?**: 1️⃣ Restrict LDAP write permissions for host accounts. 2️⃣ Ensure all admin accounts have unique, verified `krbCanonicalName` attributes. 3️⃣ Implement strict Kerberos ticket monitoring and alerting.

⚡ **Urgency**: **CRITICAL**. CVSS Score is **High** (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). While it requires initial privileges, the impact is total compromise of the identity infrastructure. Patch ASAP!