Empty Password Login Vulnerability in golang-github-go-ldap-ldap
Summary
CVE-2017-14623: In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. Affects golang-github-go-ldap-ldap across 2 version ranges.
< 2.5.1-1
< 95ede1266b237bf8e9aa5dce0b3250e51bfefe66
Fixed in 2.5.1-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The golang-github-go-ldap-ldap package is a Go library that provides functionality for interacting with LDAP servers. It is commonly used in applications that require LDAP authentication. This vulnerability allows an attacker to login with an empty password, bypassing authentication.
Vulnerability Detail
The vulnerability exists in the ldap.v2 package through version 2.5.0. If an application relies solely on the return error of the Bind function call to determine user authorization and is used with an LDAP server allowing unauthenticated bind, an attacker can exploit this by providing an empty password. This can lead to unauthorized access and potential security breaches.
How To Fix
Minimum fixed version
2.5.1-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade golang-github-go-ldap-ldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is to modify the application's authentication logic to explicitly check for empty passwords and reject them. This can be done by adding a condition to the code that handles the Bind function response, ensuring that a nil return value is not interpreted as successful authorization if the password is empty.
Conclusion
The empty password login vulnerability in the golang-github-go-ldap-ldap package allows attackers to bypass authentication and gain unauthorized access. It is crucial to update the package to version 2.5.1-1 or later to fix this issue. If immediate update is not possible, implementing the provided workaround can help mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for golang-github-go-ldap-ldap →
FAQ
The impact of this vulnerability is that an attacker can bypass authentication and gain unauthorized access to the application. This can lead to data breaches, privilege escalation, and other security risks.
Versions up to and including 2.5.0 are affected by this vulnerability. It is recommended to update to version 2.5.1-1 or later.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the recommended fix as soon as possible to mitigate the risk.
Yes, this vulnerability can be exploited remotely if the application using the golang-github-go-ldap-ldap package is accessible over the network and the LDAP server allows unauthenticated bind.
Yes, the CVSS score for this vulnerability is 8.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for golang-github-go-ldap-ldap.
