LDAP Injection In OpenAM

ID: CVE-2021-29156

Severity: high

Author: melbadry9,xelkomy

Tags: cve2021,cve,openam,ldap,injection,forgerock

Description

OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user’s email. Enumeration can allow for full password retrieval.

YAML Source

id: CVE-2021-29156

info:
  name: LDAP Injection In OpenAM
  author: melbadry9,xelkomy
  severity: high
  description: OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration can allow for full password retrieval.
  impact: |
    Allows an attacker to execute arbitrary LDAP queries and potentially gain unauthorized access to sensitive information or perform unauthorized actions
  remediation: Upgrade to OpenAM commercial version 13.5.1 or later.
  reference:
    - https://github.com/sullo/advisory-archives/blob/master/Forgerock_OpenAM_LDAP_injection.md https://hackerone.com/reports/1278050 https://www.guidepointsecurity.com/blog/ldap-injection-in-forgerock-openam-exploiting-cve-2021-29156/ https://portswigger.net/research/hidden-oauth-attack-vectors
    - https://portswigger.net/research/hidden-oauth-attack-vectors
    - https://bugster.forgerock.org/jira/browse/OPENAM-10135
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-29156
    cwe-id: CWE-74
    epss-score: 0.29536
    epss-percentile: 0.96913
    cpe: cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:*
  metadata:
    max-request: 3
    vendor: forgerock
    product: openam
    shodan-query:
      - http.title:"OpenAM"
      - http.title:"openam"
    fofa-query: title="openam"
    google-query: intitle:"openam"
  tags: cve2021,cve,openam,ldap,injection,forgerock

http:
  - method: GET
    path:
      - "{{BaseURL}}/openam/ui/PWResetUserValidation"
      - "{{BaseURL}}/OpenAM-11.0.0/ui/PWResetUserValidation"
      - "{{BaseURL}}/ui/PWResetUserValidation"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "jato.pageSession") && status_code==200'
# digest: 4a0a004730450220325c6cba40354a822d4c018548df7211cdbb0a28b91e999c32cea1add1b45f98022100a51113754bbedbcbd58721807c84ee1ef4acce42dbf27e1cf533c05acf1edd9e:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-29156.yaml"

View on Github