CVE-2020-26214: LDAP Authentication Bypass in Alerta Server
Summary
CVE-2020-26214: In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Affects alerta-server across 3 version ranges.
< 2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65
< 7.5.7
>= 8.0.0, < 8.1.0
Fixed in 7.5.7 or 8.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Alerta is an open-source monitoring tool that provides a consolidated view of alerts and notifications from various monitoring systems. It allows users to receive and manage alerts through a unified interface. The Alerta server, which is the core component of the Alerta system, is responsible for processing and distributing alerts to the appropriate users or systems. This vulnerability affects the Alerta server version 0 to 8.0.0 and 8.1.0. It specifically impacts deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization.
Vulnerability Detail
The vulnerability (CVE-2020-26214) in Alerta server allows users to bypass LDAP authentication by providing an empty password when the server is configured to use LDAP as the authorization provider. This issue arises due to a flaw in the authentication mechanism that fails to validate the password field properly. As a result, an attacker can authenticate without providing a valid password, gaining unauthorized access to the Alerta server. However, it is important to note that this vulnerability only affects deployments where LDAP servers permit unauthenticated bind requests by clients. The impact of this vulnerability can lead to unauthorized access to sensitive information or unauthorized actions within the Alerta system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.5.77.5.7pip install --upgrade "alerta-server==7.5.7" -
>= 8.0.0, < 8.1.08.1.0pip install --upgrade "alerta-server==8.1.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, LDAP administrators can disallow unauthenticated bind requests by clients. By configuring the LDAP server to reject unauthenticated authentication mechanisms, the vulnerability can be mitigated. This ensures that all authentication attempts require a valid password, preventing the bypass of LDAP authentication.
Conclusion
The LDAP authentication bypass vulnerability in Alerta server poses a risk to deployments where LDAP servers allow unauthenticated bind requests. Upgrading to version 8.1.0 or later resolves the issue, ensuring proper LDAP authentication. Alternatively, LDAP administrators can implement a workaround by disallowing unauthenticated bind requests. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for alerta-server →
FAQ
The vulnerability affects Alerta server versions 0 to 8.0.0 and 8.1.0.
The vulnerability allows unauthorized access to the Alerta server, potentially leading to unauthorized actions or access to sensitive information.
No, only deployments where LDAP servers are configured to allow unauthenticated bind requests by clients are affected.
To fix this vulnerability, upgrade to Alerta server version 8.1.0 or later.
Yes, LDAP administrators can disallow unauthenticated bind requests by clients as a workaround.
Related vulnerabilities
Recent vulnerabilities recorded for alerta-server.
