AI_ONLY_REPORT
package: ipa-4.13.1-3.el10
------
Summary: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded  
Request Body Read: oversized unauthenticated form POST requests can force  
the migration handler to read attacker-controlled request bodies fully into  
memory, causing worker memory pressure and service degradation.
Requirements to exploit: Network access to `/ipa/migration/migration.py`  
and the ability to send large POST requests with  
`application/x-www-form-urlencoded`; no authentication is required.  
Deployments that already enforce strict front-end request-body limits or do  
not expose this endpoint materially reduce exploitability.
Component affected: `ipa-4.13.1-3.el10`, `install/migration/migration.py`,  
Apache `/ipa/migration` WSGI endpoint, `application()`
Version affected: `ipa-4.13.1-3.el10`
Patch available: no released package fix established; proposed patch  
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - 5.3 (MEDIUM)
AV:N - The issue is reachable over HTTP(S) through the exposed migration  
endpoint.
AC:L - Exploitation requires only sending an oversized POST body; no  
race or special precondition was established.
PR:N - The endpoint is configured to allow unauthenticated access.
UI:N - No user interaction is required.
S:U - The impact is limited to the vulnerable service's own security  
scope.
C:N - No confidentiality impact was established.
I:N - No integrity impact was established.
A:L - The demonstrated effect is memory pressure and service degradation  
in affected workers, rather than full system compromise.
Impact: Important. Red Hat guidance classifies flaws that allow remote  
users to cause a denial of service as Important. This issue is a remote,  
unauthenticated availability flaw against a web-facing endpoint in the  
shipped configuration. It is not Critical because no code execution or  
confidentiality/integrity impact was established, and deployment-specific  
body-size limits can reduce exploitability.
Embargo: no
Reason: This is an availability-only issue with straightforward  
mitigations, including disabling the migration endpoint where unused or  
enforcing conservative request-body limits at the HTTP front end.
Acknowledgement: Aisle Research
Vulnerability Details: The password migration WSGI handler accepts  
form-encoded POST requests, trusts `CONTENT_LENGTH`, and reads that many  
bytes from `wsgi.input` into memory before validating the request contents.  
There is no application-level upper bound before the read:
```python
install/migration/migration.py
try:
     length = int(environ.get("CONTENT_LENGTH"))
except (ValueError, TypeError):
     return bad_request(start_response)


query_string = environ["wsgi.input"].read(length).decode("utf-8")
```
The shipped Apache template exposes the migration directory without  
authentication:
```apache
install/share/ipa.conf.template
Alias /ipa/migration "/usr/share/ipa/migration"
<Directory "/usr/share/ipa/migration">
     AllowOverride None
     Satisfy Any
     Require all granted
     Options ExecCGI
     AddHandler wsgi-script .py
</Directory>
```


In deployments using this endpoint, an unauthenticated client can submit  
oversized request bodies and force a WSGI worker to allocate  
attacker-controlled data in memory. This can increase RSS, slow request  
handling, and in some deployments lead to worker recycling or service  
disruption. No direct confidentiality or integrity impact was established  
from the available evidence. No request-body cap was identified in the  
shipped template configuration, although external reverse proxies or HTTP  
server hardening may reduce or block exploitability.
Steps to reproduce:
1. Deploy `ipa-4.13.1-3.el10` with the shipped Apache configuration that  
exposes `/ipa/migration/migration.py`.
2. Confirm the endpoint is reachable without authentication:
```bash
curl -k -i https://<host>/ipa/migration/migration.py -X POST  
-H 'Content-Type: application/x-www-form-urlencoded'  
--data 'username=a&password=b'
```
3. Send an oversized unauthenticated POST body:
```bash
python3 - <<'PY'
import requests
u='https://<host>/ipa/migration/migration.py'
d='username=a&password='+'A'*(200*1024*1024)
print(requests.post(u,data=d,headers={'Content-Type':'application/x-www-form-urlencoded'},verify=False,timeout=120).status_code)
PY
```
4. Repeat from multiple clients or in a loop.
5. Observe `httpd`/WSGI worker RSS growth and service degradation,  
including higher memory pressure, slower responses, or worker  
recycling/failure.
Mitigation: If the migration endpoint is not needed, disable or unpublish  
`/ipa/migration`. Otherwise, enforce a conservative request-body limit for  
this path at the HTTP front end so oversized POST bodies are rejected  
before they reach the WSGI script.
Proposed Fix: Reject negative or excessively large request bodies before  
reading from `wsgi.input`.
```diff
diff --git a/install/migration/migration.py b/install/migration/migration.py
index 0000000..0000000 100644
— a/install/migration/migration.py
+++ b/install/migration/migration.py
@@ -31,6 +31,8 @@ from ipapython import ipaldap
from ipalib import errors, create_api
logger = logging.getLogger(os.path.basename(_file_))
+MAX_REQUEST_BODY = 1024 * 1024  # 1 MiB, sufficient for username/password  
form
+
@@ -83,6 +85,10 @@ def application(environ, start_response):
try:
length = int(environ.get("CONTENT_LENGTH"))
except (ValueError, TypeError):
+        return bad_request(start_response)
+
+    if length < 0 or length > MAX_REQUEST_BODY:
return bad_request(start_response)
query_string = environ["wsgi.input"].read(length).decode("utf-8")
```
------
This report was generated using AI technology. Always review AI-generated  
content prior to use