Executive brief
Central Dogma's Active Directory authentication realm fails to escape user-supplied usernames when constructing LDAP search filters, allowing attackers to inject LDAP metacharacters. An attacker can log in as a privileged account (like Administrator) by typing a wildcard username, evade audit logs that record malformed credentials, or enumerate directory structure—all without any prior authentication. This breaks the accountability trail required by SOX, PCI-DSS, and ISO 27001.
Technical details
The vulnerable code in SearchFirstActiveDirectoryRealm.findUserDn() uses Pattern.replaceAll() to substitute a user-supplied username into an LDAP filter template (default: "cn={0}") without escaping RFC 4515 filter metacharacters: *, (, ), \, and NUL. The vulnerability flows from the HTTP login form through ShiroLoginService.usernamePassword() and directly into the LDAP filter construction. Combined with SearchControls.setCountLimit(1), which returns only the first directory match, an attacker can type "*" to land on the first directory entry (typically Administrator) and attempt authentication with any known password. Malformed filter payloads like "bob)(uid=alice" are recorded verbatim in audit logs while the LDAP search fails silently, breaking compliance accountability. The defense (RFC 4515 escaping) was never implemented; repo-wide search for escapeLdap, encodeFilter, escapeFilter, or ldapEscape returns zero hits. Patch version 0.84.0 adds the encodeLdapFilter() helper and applies it before filter substitution.
Affected products
- LINE Central Dogma < 0.84.0
Timeline
- 2026-06-22: disclosed
- 2026-06-22: patched: Fixed in version 0.84.0