CVE-2024-2698: FreeIPA Authentication Bypass Vulnerability

CVE-2024-2698 Overview

CVE-2024-2698 is an authorization flaw in FreeIPA's implementation of Microsoft Service for User (MS-SFU) constrained delegation. The vulnerability stems from an incorrect condition in ipadb_match_acl() that was introduced in FreeIPA 4.11.0 while aligning with upstream MIT Kerberos 1.20 behavior. The flawed logic causes S4U2Proxy requests to be accepted regardless of whether a matching service delegation rule exists. An authenticated attacker with low privileges can abuse this flaw to impersonate users against arbitrary services, compromising confidentiality, integrity, and availability across the Kerberos realm. The issue is classified as CWE-863: Incorrect Authorization.

Critical Impact
Authenticated attackers can bypass Kerberos constrained delegation ACLs and obtain service tickets for arbitrary services, enabling lateral movement and privilege escalation across FreeIPA-managed realms.

Affected Products

FreeIPA (including 4.12.0)
Red Hat Enterprise Linux 6, 7, 8, and 9
Red Hat Enterprise Linux EUS 8.8 and 9.2

Discovery Timeline

2024-06-12 - CVE-2024-2698 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2698

Vulnerability Analysis

The vulnerability resides in FreeIPA's Kerberos Key Distribution Center (KDC) database backend, specifically in the ipadb_match_acl() function. MIT Kerberos 1.20 introduced a fix that added a special-case handling in check_allowed_to_delegate(): when the target service argument is NULL, the KDC is probing for general constrained delegation rules rather than authorizing a specific S4U2Proxy request. That probe path is not intended to grant delegation.

When FreeIPA 4.11.0 mirrored the upstream MIT Kerberos 1.20 change, the port introduced a logic error. The permissive branch of ipadb_match_acl() is executed both when the target service argument is set and when it is unset. As a result, the KDC treats general delegation probes and specific S4U2Proxy authorization checks identically, returning success in both cases.

Root Cause

The root cause is a missing conditional check in ipadb_match_acl(). The function must distinguish between a general probe (target service == NULL) and an actual S4U2Proxy authorization request (target service != NULL). Because the same code path returns success for both, no delegation ACL is ever enforced against the requested service principal. This is an incorrect authorization defect [CWE-863] in the KDC's constrained delegation policy engine.

Attack Vector

An attacker requires an authenticated Kerberos principal within the FreeIPA realm to exploit CVE-2024-2698. The attacker requests an S4U2Self ticket for a target user against a service principal they control, then submits an S4U2Proxy request to forward that ticket to any other service in the realm. The KDC's ipadb_match_acl() returns success even when no ipaAllowedToPerform;memberPrincipal rule authorizes the delegation. The attacker receives a valid service ticket impersonating the target user and can access downstream services such as HTTP, LDAP, CIFS, or database endpoints. No user interaction is required, and the attack is executable over the network against any exposed KDC.

See the Red Hat CVE Details for CVE-2024-2698 and Red Hat Bug Report #2270353 for additional technical context. No public proof-of-concept has been published.

Detection Methods for CVE-2024-2698

Indicators of Compromise

Unexpected S4U2Proxy TGS-REQ traffic to the KDC where the requesting service principal lacks a corresponding ipaAllowedToPerform;memberPrincipal attribute in the FreeIPA directory.
Service tickets issued to principals that impersonate privileged users against services those principals should not access.
Audit log entries in /var/log/krb5kdc.log showing successful TGS_REQ ... for user (S4U2Proxy) events without matching delegation policy.

Detection Strategies

Enable KDC audit logging and correlate S4U2Proxy events against the current FreeIPA constrained delegation ACL configuration to identify unauthorized delegations.
Baseline legitimate service-to-service delegation flows in the environment, then alert on any S4U2Proxy request originating from a service principal outside that baseline.
Monitor authentication telemetry for anomalous ticket-granting-service requests where the client, target user, and requested service combination has no historical precedent.

Monitoring Recommendations

Forward krb5kdc.log and FreeIPA directory audit logs to a centralized analytics platform for correlation with endpoint and application telemetry.
Alert on modifications to ipaAllowedToPerform attributes in the FreeIPA LDAP tree, since attackers may attempt to add legitimate delegation rules after exploitation.
Track service ticket usage against sensitive services (LDAP admin, HTTP administrative interfaces, CIFS shares) and flag tickets obtained via S4U2Proxy for review.

How to Mitigate CVE-2024-2698

Immediate Actions Required

Apply the FreeIPA and MIT Kerberos updates from the referenced Red Hat Security Advisories to all IPA servers, replicas, and clients acting as KDCs.
Inventory all service principals with constrained delegation entries and remove any that are not required for business operations.
Rotate credentials and Kerberos keys for service accounts that could have been abused through unauthorized S4U2Proxy requests.

Patch Information

Red Hat has released fixes through advisories RHSA-2024:3754, RHSA-2024:3755, RHSA-2024:3757, and RHSA-2024:3759. Upstream FreeIPA users should upgrade to the version documented in the FreeIPA 4.12.1 Release Notes. Fedora users should apply the update described in the Fedora Package Announcement.

Workarounds

Remove all ipaAllowedToPerform;memberPrincipal entries where feasible so that no service is authorized for constrained delegation until patches are applied.
Restrict network access to the KDC ports (TCP/UDP 88 and 464) to trusted management networks to reduce the population of principals able to submit S4U2Proxy requests.
Disable or lock service accounts that have Kerberos delegation privileges but are not actively required until systems are patched.

bash

# Query and review current constrained delegation rules on a FreeIPA server
ipa servicedelegationrule-find
ipa servicedelegationtarget-find

# Remove a specific delegation rule pending patch deployment
ipa servicedelegationrule-del <rule-name>

# Apply vendor updates on Red Hat Enterprise Linux systems
sudo dnf update ipa-server ipa-client krb5-server krb5-libs
sudo systemctl restart krb5kdc.service ipa.service