CyberRota Analysis
AI-GeneratedA vulnerability exists in SSSD's LDAP sudo provider that allows an authenticated attacker with write access to any subtree to inject a sudoRole object, potentially granting root-level sudo privileges across all SSSD-enrolled hosts. This flaw arises when the ldap_sudo_search_base option is not explicitly configured, leading to an unrestricted search of the LDAP directory tree for sudoRole objects. Organizations using SSSD for LDAP authentication should prioritize addressing this issue to mitigate the risk of unauthorized privilege escalation.
Original NVD Description
A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.