#VU9424 Authentication bypass in Spring-LDPA - CVE-2017-8028

Vulnerability identifier: #VU9424

Vulnerability risk: Low

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-8028

CWE-ID: CWE-592

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Spring-LDPA
Web applications / JS libraries

Vendor: Pivotal

Description
The vulnerability allows a remote attacker to bypass authentication on the target system.

The weakness exists due to some LDAP vendors require an explicit operation for the LDAP bind to take effect. A remote attacker with knowledge of the username can authenticate with an arbitrary password when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch.

Mitigation
Update to version 2.3.2.

Vulnerable software versions

Spring-LDPA: 1.3.0 - 2.3.1

---

External links
https://pivotal.io/security/cve-2017-8028

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.