A flaw was found in FreeIPA's idp-add command. ipapython.ipautil.template_str() evaluates any 'eval(...)' token found in a post-substitution string using Python's eval(). ipaserver/plugins/idp.py passes the caller-supplied --organization and --base-url values (ipaidporg/ipaidpbaseurl), which have no input validation, into this function via provider templates (okta, keycloak, microsoft). The LDAPCreate command framework runs this evaluation inside pre_callback, before the LDAP access control check that restricts idp-add to the 'External IdP server Administrators' privilege is ever evaluated. As a result, any authenticated IPA principal, regardless of privilege level, can trigger this evaluation.

The regular expression that locates the eval(...) token forbids parentheses inside the evaluated expression, which prevents invoking any function and therefore prevents code execution. However, using parenthesis-free short-circuit boolean expressions, an attacker can distinguish, via the JSON-RPC error code returned by the server, whether a guessed condition is true, and combined with parenthesis-free star and dict-unpacking syntax, this allows systematic enumeration and extraction of the entire environment of the affected server process, with no prior knowledge of variable names required. Separately, a short expression exploiting Python's right-associative exponentiation operator reliably exhausts the affected process's available memory within seconds, providing a cheap, repeatable denial-of-service primitive.

Both primitives are reachable by any authenticated IPA principal, not only those holding the privilege the idp-add command is nominally restricted to.