SB2022041201 - Remote code execution in NGINX LDAP reference implementation

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022041201

SB2022041201 - Remote code execution in NGINX LDAP reference implementation

Published: April 12, 2022

Security Bulletin ID SB2022041201
Severity
High
Patch available
NO
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Input validation error (CVE-ID: N/A)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation of user-supplied input when processing HTTP request within NGINX LDAP reference implementation, when nginx or nginx plus are configured to proxy LDAP requests. A remote attacker can pass specially crafted input to the application and bypass LDAP authentication or execute arbitrary commands on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.


Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References