Reflected XSS Vulnerability in phpLDAPadmin: Execute Arbitrary JavaScript via 'element' Parameter
Summary
CVE-2024-9101: A reflected cross-site scripting (XSS) vulnerability in the 'Entry Chooser' of phpLDAPadmin (version 1.2.1 through the latest version, 1.2.6.7) allows attackers to execute arbitrary JavaScript in the user's browser via t... Affects phpldapadmin versions < f713afc8d164169516c91b0988531f2accb9bce6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
phpLDAPadmin is a web-based application used for managing LDAP directories. It provides a user-friendly interface for administrators to interact with LDAP servers, allowing for easy management of users, groups, and other directory entries. The application is widely used due to its simplicity and effectiveness in handling LDAP operations. However, certain versions of phpLDAPadmin are vulnerable to a reflected cross-site scripting (XSS) attack, which can compromise user security.
Vulnerability Detail
The vulnerability identified as CVE-2024-9101 is a reflected cross-site scripting (XSS) issue found in the 'Entry Chooser' of phpLDAPadmin versions 1.2.1 through 1.2.6.7. This vulnerability arises from the unsanitized passing of the 'element' parameter to the JavaScript 'eval' function, allowing attackers to execute arbitrary JavaScript in the user's browser. Exploitation of this vulnerability is contingent upon specific conditions, particularly that the 'opener' is correctly set, which may limit the scope of potential attacks but still poses a significant risk to users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can restrict access to the phpLDAPadmin interface by implementing proper authentication and authorization measures, ensuring that only trusted users can access the application. Additionally, users should avoid clicking on untrusted links that may exploit this vulnerability.
Conclusion
The CVE-2024-9101 vulnerability in phpLDAPadmin poses a significant risk due to its potential for reflected XSS attacks. Users are strongly encouraged to update their installations to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for phpldapadmin →
FAQ
CVE-2024-9101 is a reflected XSS vulnerability in phpLDAPadmin that allows attackers to execute arbitrary JavaScript in a user's browser.
Versions 1.2.1 through 1.2.6.7 of phpLDAPadmin are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can allow attackers to execute malicious scripts in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious activities.
Yes, users are advised to update to a version of phpLDAPadmin later than 1.2.6.7, which contains the necessary security patches.
Related vulnerabilities
Recent vulnerabilities recorded for phpldapadmin.
