CVE-2017-8028

spring-ldap: Authentication with userSearch and STARTTLS allows authentication with arbitrary password

Severity Score

8.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

En Pivotal Spring-LDAP en versiones 1.3.0 - 2.3.1, al conectarse a algunos servidores LDAP, cuando no se enlazan atributos adicionales y cuando se emplea LDAP BindAuthenticator con org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy como la estrategia de autenticación y configurando userSearch, se permite la autenticación con una contraseña arbitraria cuando el nombre de usuario es correcto. Esto ocurre porque algunos fabricantes LDAP requieren una operación explícita para que el enlace LDAP tenga efecto.

A vulnerability was found in spring-ldap that allows an attacker to authenticate with an arbitrary password. When spring-ldap connected to some LDAP servers, when no additional attributes are bound, when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and when setting userSearch, authentication is allowed with an arbitrary password when the username is correct.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-04-21 CVE Reserved
2017-11-23 CVE Published
2023-06-23 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-287: Improper Authentication

CAPEC

References (7)

URL	Tag	Source
https://lists.debian.org/debian-lts-announce/2017/11/msg00026.html	Mailing List
https://www.oracle.com/security-alerts/cpujan2021.html	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/errata/RHSA-2018:0319	2021-01-20
https://pivotal.io/security/cve-2017-8028	2021-01-20
https://www.debian.org/security/2017/dsa-4046	2021-01-20
https://access.redhat.com/security/cve/CVE-2017-8028	2018-02-14
https://bugzilla.redhat.com/show_bug.cgi?id=1510968	2018-02-14

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				1.3.0 Search vendor "Pivotal Software" for product "Spring-ldap" and version "1.3.0"		-		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				1.3.1 Search vendor "Pivotal Software" for product "Spring-ldap" and version "1.3.1"		-		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				1.3.1 Search vendor "Pivotal Software" for product "Spring-ldap" and version "1.3.1"		rc1		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				1.3.2 Search vendor "Pivotal Software" for product "Spring-ldap" and version "1.3.2"		-		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				2.0.0 Search vendor "Pivotal Software" for product "Spring-ldap" and version "2.0.0"		-		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				2.0.1 Search vendor "Pivotal Software" for product "Spring-ldap" and version "2.0.1"		-		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				2.0.2 Search vendor "Pivotal Software" for product "Spring-ldap" and version "2.0.2"		-		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				2.0.3 Search vendor "Pivotal Software" for product "Spring-ldap" and version "2.0.3"		-		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				2.0.4 Search vendor "Pivotal Software" for product "Spring-ldap" and version "2.0.4"		-		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				2.1.0 Search vendor "Pivotal Software" for product "Spring-ldap" and version "2.1.0"		-		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				2.2.0 Search vendor "Pivotal Software" for product "Spring-ldap" and version "2.2.0"		-		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				2.2.1 Search vendor "Pivotal Software" for product "Spring-ldap" and version "2.2.1"		-		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				2.3.0 Search vendor "Pivotal Software" for product "Spring-ldap" and version "2.3.0"		-		Affected
Pivotal Software Search vendor "Pivotal Software"		Spring-ldap Search vendor "Pivotal Software" for product "Spring-ldap"				2.3.1 Search vendor "Pivotal Software" for product "Spring-ldap" and version "2.3.1"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0"		-		Affected