Executive brief
Apache Derby, a popular database engine, is vulnerable to an authentication bypass when configured to use LDAP for user verification. An attacker can use a specially crafted username to gain unauthorized access to the database. This could allow them to steal or corrupt sensitive data, crash the system by filling up disk space, or execute malicious code on the server.
Technical details
An LDAP injection vulnerability exists in the Apache Derby authenticator component (CWE-74, CWE-94). The vulnerability arises from improper neutralization of special elements in usernames when Derby is configured to use LDAP authentication. A remote, unauthenticated attacker can provide a specially crafted username to bypass authentication checks. Successful exploitation allows the attacker to create junk databases to cause denial-of-service via disk exhaustion, execute arbitrary code with the privileges of the Derby server process, or perform unauthorized SQL operations if granular GRANT/REVOKE permissions are not implemented. The issue is addressed in Derby 10.17.1.0 (for Java 21) and backported to versions 10.16.1.2, 10.15.2.1, and 10.14.2.1.
Affected products
- Apache Derby >= 10.1.1.0, <= 10.16.1.1
Timeline
- 2023-11-20: advisory
- 2023-11-20: disclosed