Summary
FOG's management adInfo() endpoint may expose the configured default domain-join password in a JSON response. Because the endpoint can reportedly be reached through the iPXE dispatch path without an authenticated session, a remote requester could obtain credentials intended for Active Directory integration.
FOG's management adInfo() endpoint may expose the configured default domain-join password in a JSON response. Because the endpoint can reportedly be reached through the iPXE dispatch path without an authenticated session, a remote requester could obtain credentials intended for Active Directory integration.
Affected context
The issue occurs in FOG deployments where the management adInfo() endpoint returns the FOG_AD_DEFAULT_PASSWORD value in the domainpass JSON field. The endpoint is associated with host and group Active Directory configuration interfaces and may be dispatchable through the iPXE route without requiring an authenticated session. Exposure depends on the endpoint being reachable and a default domain-join credential being configured.
The issue occurs in FOG deployments where the management adInfo() endpoint returns the FOG_AD_DEFAULT_PASSWORD value in the domainpass JSON field. The endpoint is associated with host and group Active Directory configuration interfaces and may be dispatchable through the iPXE route without requiring an authenticated session. Exposure depends on the endpoint being reachable and a default domain-join credential being configured.
Exploit preconditions
- Attack surface: FOG web management and iPXE dispatch functionality
- Required access: Ability to send requests to the exposed endpoint; an authenticated session may not be required
- Trigger point: Invocation of the adInfo() endpoint through the relevant node=ipxe dispatch path
- Why exploitation is possible: The response includes a sensitive domain credential in a JSON field without adequately enforcing authentication or limiting disclosure
- Attack surface: FOG web management and iPXE dispatch functionality
- Required access: Ability to send requests to the exposed endpoint; an authenticated session may not be required
- Trigger point: Invocation of the adInfo() endpoint through the relevant node=ipxe dispatch path
- Why exploitation is possible: The response includes a sensitive domain credential in a JSON field without adequately enforcing authentication or limiting disclosure
Why this happens
The underlying flaw is an information exposure condition in which a sensitive credential is included in an endpoint response intended for administrative configuration workflows. Returning the FOG_AD_DEFAULT_PASSWORD value through a potentially unauthenticated management path violates least-disclosure principles and maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
The underlying flaw is an information exposure condition in which a sensitive credential is included in an endpoint response intended for administrative configuration workflows. Returning the FOG_AD_DEFAULT_PASSWORD value through a potentially unauthenticated management path violates least-disclosure principles and maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Potential impact
- An unauthenticated requester may obtain the default domain-join credential
- Attackers could use the disclosed credential to authenticate to related domain services, depending on its privileges and scope
- Compromise of the credential could enable unauthorized host enrollment or domain-related activity
- The exposed secret could support lateral movement or broader infrastructure compromise
- An unauthenticated requester may obtain the default domain-join credential
- Attackers could use the disclosed credential to authenticate to related domain services, depending on its privileges and scope
- Compromise of the credential could enable unauthorized host enrollment or domain-related activity
- The exposed secret could support lateral movement or broader infrastructure compromise
General mitigation guidance
Mitigation generally focuses on preventing sensitive credentials from being returned through client-accessible responses and enforcing authentication at every management endpoint.
Common defensive patterns include:
- Remove passwords and other secrets from API responses, including administrative configuration responses
- Require strong authentication and authorization for management and iPXE dispatch paths
- Use scoped, least-privileged domain-join accounts rather than broadly privileged credentials
- Store secrets in protected server-side mechanisms and retrieve them only when required for a narrowly defined operation
- Rotate any credential that may have been exposed and monitor its subsequent use
- Apply network segmentation and access controls around management interfaces
Mitigation generally focuses on preventing sensitive credentials from being returned through client-accessible responses and enforcing authentication at every management endpoint.
Common defensive patterns include:
- Remove passwords and other secrets from API responses, including administrative configuration responses
- Require strong authentication and authorization for management and iPXE dispatch paths
- Use scoped, least-privileged domain-join accounts rather than broadly privileged credentials
- Store secrets in protected server-side mechanisms and retrieve them only when required for a narrowly defined operation
- Rotate any credential that may have been exposed and monitor its subsequent use
- Apply network segmentation and access controls around management interfaces
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and API review rules that flag password or secret fields serialized into responses
- Code review searches for environment-backed credentials included in JSON or administrative endpoint output
- Tests that invoke management routes without authentication and verify that sensitive fields are absent
- Web application firewall or reverse-proxy policies restricting unauthenticated access to management and iPXE endpoints
- Audit-log analysis for unusual requests to adInfo(), node=ipxe, and related configuration routes
- Automated security testing that checks for credential disclosure in API responses
Organizations can look for this class of issue through:
- Static analysis and API review rules that flag password or secret fields serialized into responses
- Code review searches for environment-backed credentials included in JSON or administrative endpoint output
- Tests that invoke management routes without authentication and verify that sensitive fields are absent
- Web application firewall or reverse-proxy policies restricting unauthenticated access to management and iPXE endpoints
- Audit-log analysis for unusual requests to adInfo(), node=ipxe, and related configuration routes
- Automated security testing that checks for credential disclosure in API responses
