LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER is not forwarded, unauthenticated attackers can send a wildcard username via HTTP Basic Authorization (PHP_AUTH_USER) to match all users and groups and gain admin access.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Librenms Librenms
cpe:2.3:a:librenms:librenms:*:*:*:*:*:*:*:*
|
— |
26.9.0
|
References 2
https://github.com/librenms/librenms/security/advisories/GHSA-7cmx-65c5-8h8v
GitHub Security Advisory (GHSA-7cmx-65c5-8h8v)
https://www.vulncheck.com/advisories/librenms-before-26.9.0-ldap-filter-injecti…
VulnCheck Advisory: LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header