Executive brief
The 'is-user-valid' library, used to verify user credentials against LDAP directories, contains a security flaw that allows attackers to manipulate directory queries. By providing specially crafted input, an attacker could bypass authentication checks or gain unauthorized access to sensitive user information stored in the directory. This could lead to unauthorized account access and the exposure of private corporate data.
Technical details
The 'is-user-valid' package fails to properly sanitize user-supplied input before incorporating it into LDAP search filters (CWE-90). This vulnerability allows a remote, unauthenticated attacker to perform LDAP injection by submitting malicious characters in input fields. Successful exploitation can result in the manipulation of the LDAP query logic, enabling the attacker to bypass authentication mechanisms or extract sensitive attributes from the LDAP directory. As of the latest advisory, there is no known fixed version available for this package.
Affected products
- is-user-valid project is-user-valid All versions up to and including 1.1.2
Timeline
- 2021-01-08: disclosed: Vulnerability disclosed by researcher Alessio Della Libera
- 2021-02-11: advisory: NVD and Snyk published the vulnerability details
- 2021-04-13: advisory: GitHub Advisory published