CVE-2021-43350: Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection
Summary
CVE-2021-43350: Apache Traffic Control Traffic Ops Vulnerable to LDAP Injection. Affects github.com/apache/trafficcontrol across 2 version ranges.
>= 5.1.0, < 5.1.4
>= 6.0.0, < 6.0.1
Fixed in 5.1.4 or 6.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Traffic Control Traffic Ops is a package written in Go that provides a web-based user interface for managing and monitoring Apache Traffic Control CDN (Content Delivery Network) deployments. It allows administrators to configure and control various aspects of the CDN, such as caching, routing, and content delivery. However, an unauthenticated user can exploit a vulnerability in the package to inject unsanitized content into the LDAP filter, potentially leading to unauthorized access or data leakage.
Vulnerability Detail
The vulnerability (CVE-2021-43350) in Apache Traffic Control Traffic Ops allows an attacker to send a specially-crafted username to the POST /login endpoint of any API version. This input is not properly sanitized, allowing the attacker to inject unsanitized content into the LDAP filter. By manipulating the LDAP filter, an attacker can bypass authentication mechanisms, gain unauthorized access to the system, or extract sensitive information. The impact of this vulnerability is critical, as it can lead to complete compromise of the affected system.
How To Fix
Latest published version: v7.0.1+incompatible as of 23 Oct 2026
go get github.com/apache/trafficcontrol@v7.0.1+incompatibleUpgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 5.1.0, < 5.1.45.1.4go get github.com/apache/trafficcontrol@v5.1.4 -
>= 6.0.0, < 6.0.16.0.1go get github.com/apache/trafficcontrol@v6.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to implement input validation and sanitization on the server-side. This can be done by applying proper input validation techniques, such as whitelisting allowed characters and escaping special characters, before using user input in LDAP filters. Implementing strict input validation can help prevent LDAP injection attacks until the upgrade can be performed.
Conclusion
The vulnerability (CVE-2021-43350) in Apache Traffic Control Traffic Ops allows an unauthenticated user to inject unsanitized content into the LDAP filter, potentially leading to unauthorized access or data leakage. It is critical to upgrade to version 6.0.1 or later to mitigate the risk of exploitation. If immediate upgrade is not possible, implementing input validation and sanitization on the server-side can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/apache/trafficcontrol →
FAQ
Apache Traffic Control Traffic Ops is a web-based user interface for managing and monitoring Apache Traffic Control CDN deployments. It provides administrators with the ability to configure and control various aspects of the CDN, such as caching, routing, and content delivery.
LDAP injection is a type of attack where an attacker manipulates user input that is used in LDAP filters to bypass authentication mechanisms, gain unauthorized access, or extract sensitive information. In this case, the vulnerability in Apache Traffic Control Traffic Ops allows an attacker to inject unsanitized content into the LDAP filter, potentially leading to unauthorized access or data leakage.
The impact of this vulnerability is critical. An attacker can exploit the LDAP injection vulnerability to bypass authentication mechanisms, gain unauthorized access to the system, or extract sensitive information. This can lead to complete compromise of the affected system and potential data breaches.
To fix this vulnerability, it is recommended to upgrade to Apache Traffic Control Traffic Ops version 6.0.1 or later. This version includes a fix for the LDAP injection vulnerability and ensures that user input is properly sanitized before being used in LDAP filters.
If upgrading to the latest version is not immediately possible, a temporary workaround is to implement input validation and sanitization on the server-side. This can be done by applying proper input validation techniques, such as whitelisting allowed characters and escaping special characters, before using user input in LDAP filters.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/apache/trafficcontrol.
