LDAP Injection In OpenAM

highseverity

7.5CVSS score

76.8%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration can allow for full password retrieval.

Impact

Allows an attacker to execute arbitrary LDAP queries and potentially gain unauthorized access to sensitive information or perform unauthorized actions

Fix

Upgrade to OpenAM commercial version 13.5.1 or later.

How to confirm it

Send: GET {{BaseURL}}/openam/ui/PWResetUserValidation ; GET {{BaseURL}}/OpenAM-11.0.0/ui/PWResetUserValidation ; GET {{BaseURL}}/ui/PWResetUserValidation
Positive when: contains(body, "jato.pageSession") && status_code==200

Run it with nuclei: nuclei -id CVE-2021-29156 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-29156

info:
  name: LDAP Injection In OpenAM
  author: melbadry9,xelkomy
  severity: high
  description: OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration can allow for full password retrieval.
  impact: |
    Allows an attacker to execute arbitrary LDAP queries and potentially gain unauthorized access to sensitive information or perform unauthorized actions
  remediation: Upgrade to OpenAM commercial version 13.5.1 or later.
  reference:
    - https://github.com/sullo/advisory-archives/blob/master/Forgerock_OpenAM_LDAP_injection.md
    - https://hackerone.com/reports/1278050
    - https://www.guidepointsecurity.com/blog/ldap-injection-in-forgerock-openam-exploiting-cve-2021-29156/
    - https://portswigger.net/research/hidden-oauth-attack-vectors
    - https://bugster.forgerock.org/jira/browse/OPENAM-10135
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-29156
    cwe-id: CWE-74
    epss-score: 0.76846
    epss-percentile: 0.99552
    cpe: cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: forgerock
    product: openam
    shodan-query:
      - http.title:"OpenAM"
      - http.title:"openam"
    fofa-query: title="openam"
    google-query: intitle:"openam"
  tags: cve2021,cve,openam,ldap,injection,forgerock,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/openam/ui/PWResetUserValidation"
      - "{{BaseURL}}/OpenAM-11.0.0/ui/PWResetUserValidation"
      - "{{BaseURL}}/ui/PWResetUserValidation"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "jato.pageSession") && status_code==200'

References

Use this check only on systems you are authorised to test. Where the data comes from