nginxinc/nginx-ldap-auth

Query inject attack / security vulnerability

valodzka opened this issue · 5 comments

valodzka commented

Using simple python formatting for X-Ldap-Template and user input opens the door to ldap query injection attacks. For example:

X-Ldap-Template: (|(&(memberOf=x)(cn=%(username)s))(&(memberOf=y)(cn=%(username)s)))

Then passing username: x))((cn=username bypass group check.

agileknight commented

This might help to improve the implementation: https://rules.sonarsource.com/python/RSPEC-2078
Until the code is improved, if I'm not mistaken, using a Query like this should improve the situation:
X-Ldap-Template: (&(cn=%(username)s)(|(memberOf=x)(memberOf=y)))

lcrilly commented

Thanks! Addressed with 763f23b

For future reference, please direct security issues to security-alerts@nginx.org

marco-silva0000 commented

I don't understand how that commit addresses the issue.

Will there be a release tag with this included?

valodzka commented

I also don't see how it was fixed.

valodzka commented

Also emails returns:

450 4.1.1 <[security-alerts@nginx.org](mailto:security-alerts@nginx.org)>: Recipient address rejected: User unknown in virtual mailbox table