Executive brief
ldapauth-fork is a Node.js library used to authenticate users against LDAP directories. An attacker can inject malicious LDAP commands through the username field, potentially allowing unauthorized access to directory data or bypass of authentication controls without requiring any special credentials.
Technical details
This is an LDAP injection vulnerability (CWE-90) in the username parameter handling of ldapauth-fork versions 2.2.4 and earlier. The root cause is insufficient input validation and sanitization of the username field before constructing LDAP queries. An attacker can send a specially crafted username containing LDAP filter metacharacters to manipulate the LDAP query logic, potentially extracting sensitive directory information or bypassing authentication. The attack requires network access to an application using the vulnerable library but no authentication or user interaction. The original ldapauth library is unmaintained; however, ldapauth-fork was patched in version 2.3.3.
Affected products
- ldapauth ldapauth 2.2.4 and earlier
- ldapauth ldapauth-fork before 2.3.3
Timeline
- 2015-05-22: disclosed: Vulnerability reported on GitHub issue #21
- 2015: patched: ldapauth-fork patched in version 2.3.3
- 2020-08-31: advisory: GHSA-82mg-x548-gq3j published