CVE-2015-7294: LDAP Injection in ldapauth-fork
Summary
CVE-2015-7294: LDAP Injection in ldapauth. Affects ldapauth-fork versions < 2.3.3. Fixed in 2.3.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ldapauth-fork is an npm package used for LDAP authentication. It allows applications to authenticate users against an LDAP server. Versions 2.2.4 and earlier of ldapauth-fork are affected by an LDAP injection vulnerability. This vulnerability enables an attacker to inject and execute arbitrary LDAP commands through the username parameter.
Vulnerability Detail
The LDAP injection vulnerability in ldapauth-fork version 2.2.4 and earlier allows an attacker to manipulate the username parameter and inject malicious LDAP commands. This can lead to unauthorized access, data leakage, or even remote code execution on the LDAP server. The vulnerability has a CVSS score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-90.
How To Fix
Minimum fixed version
2.3.3
This is the first release that contains the fix.
npm install ldapauth-fork@2.3.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The LDAP injection vulnerability in ldapauth-fork (CVE-2015-7294) allows an attacker to inject and execute arbitrary LDAP commands. It is recommended to update to the latest version of ldapauth-fork (2.3.3 or greater) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ldapauth-fork →
FAQ
ldapauth-fork is an npm package used for LDAP authentication. It allows applications to authenticate users against an LDAP server.
LDAP injection is a type of security vulnerability that occurs when untrusted data is inserted into an LDAP query without proper sanitization. It allows an attacker to manipulate the query and execute arbitrary LDAP commands.
LDAP injection can lead to unauthorized access, data leakage, or remote code execution on the LDAP server. An attacker can manipulate the LDAP query to bypass authentication, retrieve sensitive information, or execute arbitrary commands.
ldapauth is not actively maintained and does not have a patch available. It is recommended to update to ldapauth-fork (2.3.3 or greater) as a replacement.
To update ldapauth-fork, run the following command: npm install ldapauth-fork@latest
