Executive brief
LemonLDAP::NG Handler is an authentication and authorization module used to protect web applications. A flaw in URL normalization allows attackers to bypass access control rules by crafting specially encoded URLs, potentially gaining unauthorized access to protected resources.
Technical details
The vulnerability is an authentication bypass (CWE-287) caused by insufficient URL normalization in the access control rule enforcement mechanism. When URL-encoded requests are processed, the handler fails to properly normalize URLs before checking them against access rules, allowing attackers to craft encoded payloads that evade filtering. The attack is network-accessible and requires no authentication or user interaction. An attacker can bypass URL access rules to access protected resources they should not be able to reach. The vulnerability is fixed in version 0.5.2 of the lemonldap-ng-handler npm package.
Affected products
- LemonLDAPNG node-lemonldap-ng-handler < 0.5.2
Timeline
- 2020-09-09: disclosed
- 2020-09-09: patched: Version 0.5.2 released