Executive brief
openDCIM, an open-source tool for managing data center infrastructure, contains a security flaw in its installation and upgrade components. The software fails to verify if a user has administrative rights before allowing them to modify sensitive LDAP configuration settings. This could allow any logged-in user to change system settings, potentially leading to a full takeover of the application and its data.
Technical details
A missing authorization vulnerability (CWE-862) exists in openDCIM's 'install.php' and 'container-install.php' scripts. While the application uses a role-based access control system, these specific scripts—which handle installation and upgrades—fail to enforce 'SiteAdmin' role checks. Consequently, any authenticated user can access and modify LDAP configuration parameters. In specific environments, such as certain Docker deployments where the 'REMOTE_USER' environment variable is statically set without actual authentication enforcement, this endpoint may be accessible to unauthenticated remote attackers. This vulnerability serves as a primary entry point for a multi-stage exploit chain involving SQL injection and remote code execution.
Affected products
- openDCIM openDCIM Through 23.04 (commit 4467e9c4)
Timeline
- 2026-02-26: disclosed: Initial researcher blog post published
- 2026-02-27: advisory: CVE-2026-28515 published
References
- https://chocapikk.com/posts/2026/opendcim-sqli-to-rce/
- https://github.com/Chocapikk/opendcim-exploit
- https://github.com/opendcim/openDCIM/blob/4467e9c4/container-install.php
- https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php
- https://github.com/opendcim/openDCIM/blob/4467e9c4/install.php
- https://github.com/opendcim/openDCIM/pull/1664
- https://github.com/opendcim/openDCIM/pull/1664/changes/8f7ab2a710086a9c8c269560793e47c577ddda09