OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration can allow for full password retrieval.
PoC代码[已公开]
id: CVE-2021-29156
info:
name: LDAP Injection In OpenAM
author: melbadry9,xelkomy
severity: high
description: OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration can allow for full password retrieval.
impact: |
Allows an attacker to execute arbitrary LDAP queries and potentially gain unauthorized access to sensitive information or perform unauthorized actions
remediation: Upgrade to OpenAM commercial version 13.5.1 or later.
reference:
- https://github.com/sullo/advisory-archives/blob/master/Forgerock_OpenAM_LDAP_injection.md https://hackerone.com/reports/1278050 https://www.guidepointsecurity.com/blog/ldap-injection-in-forgerock-openam-exploiting-cve-2021-29156/ https://portswigger.net/research/hidden-oauth-attack-vectors
- https://portswigger.net/research/hidden-oauth-attack-vectors
- https://bugster.forgerock.org/jira/browse/OPENAM-10135
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2021-29156
cwe-id: CWE-74
epss-score: 0.92185
epss-percentile: 0.99704
cpe: cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:*
metadata:
max-request: 3
vendor: forgerock
product: openam
shodan-query:
- http.title:"OpenAM"
- http.title:"openam"
fofa-query: title="openam"
google-query: intitle:"openam"
tags: cve2021,cve,openam,ldap,injection,forgerock
http:
- method: GET
path:
- "{{BaseURL}}/openam/ui/PWResetUserValidation"
- "{{BaseURL}}/OpenAM-11.0.0/ui/PWResetUserValidation"
- "{{BaseURL}}/ui/PWResetUserValidation"
matchers:
- type: dsl
dsl:
- 'contains(body, "jato.pageSession") && status_code==200'
# digest: 4b0a00483046022100a5a1e4bf4be14a62bdaf3916ca67bb729fb3481d7fbe893c8fec748f5921d26e022100e330095f826059d2db337b4d4945da534593a736a5ba8b34cb553ba2d872cb7a:922c64590222798bb761d5b6d8e72950