OpenLDAP Vulnerability: Improper Authorization in Multi-Tenant Deployments
Summary
ALPINE-CVE-2019-13057: An issue was discovered in the server in OpenLDAP before 2.4.48. Affects openldap versions < 2.4.48-r0. Fixed in 2.4.48-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP), which is used for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. It is widely utilized for user authentication and directory services in various applications. The vulnerability in question affects OpenLDAP versions prior to 2.4.48, where improper handling of rootDN privileges can lead to unauthorized access in multi-tenant environments.
Vulnerability Detail
An issue was discovered in the server component of OpenLDAP before version 2.4.48. The vulnerability arises when a server administrator delegates rootDN privileges for certain databases while attempting to maintain isolation between different databases. In such configurations, the slapd server does not adequately prevent a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz control. This flaw can lead to unauthorized access and data exposure, particularly in multi-tenant deployments where different levels of trust exist among administrators.
How To Fix
Minimum fixed version
2.4.48-r0
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting the delegation of rootDN privileges to prevent unauthorized access until the package can be updated. This may involve reviewing and adjusting the access controls and configurations of your OpenLDAP setup.
Conclusion
The vulnerability in OpenLDAP prior to version 2.4.48 poses a significant risk in multi-tenant environments due to improper authorization handling. It is crucial to update to the patched version to mitigate potential unauthorized access and data exposure. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for openldap →
FAQ
The CVSS score of this vulnerability is 4.9, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive data and potentially compromise the integrity of multi-tenant applications.
Yes, the vulnerability is particularly relevant in configurations where a server administrator and a database administrator have different levels of trust.
If an immediate update is not possible, implement strict access controls and review your delegation of rootDN privileges as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
