// For flags

CVE-2022-24851

Stored XSS and path traversal in LDAPAccountManager/lam

Severity Score

4.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

LDAP Account Manager (LAM) is an open source web frontend for managing entries stored in an LDAP directory. The profile editor tool has an edit profile functionality, the parameters on this page are not properly sanitized and hence leads to stored XSS attacks. An authenticated user can store XSS payloads in the profiles, which gets triggered when any other user try to access the edit profile page. The pdf editor tool has an edit pdf profile functionality, the logoFile parameter in it is not properly sanitized and an user can enter relative paths like ../../../../../../../../../../../../../usr/share/icons/hicolor/48x48/apps/gvim.png via tools like burpsuite. Later when a pdf is exported using the edited profile the pdf icon has the image on that path(if image is present). Both issues require an attacker to be able to login to LAM admin interface. The issue is fixed in version 7.9.1.

LDAP Account Manager (LAM) es un frontend web de código abierto para administrar las entradas almacenadas en un directorio LDAP. La herramienta de edición de perfiles presenta una funcionalidad de edición de perfiles, los parámetros en esta página no están saneados apropiadamente y por lo tanto conlleva a ataques de tipo XSS almacenados. Un usuario autenticado puede almacenar cargas útiles de tipo XSS en los perfiles, que son desencadenadas cuando cualquier otro usuario intenta acceder a la página de edición de perfiles. La herramienta de edición de pdf presenta una funcionalidad de edición de perfil de pdf, el parámetro logoFile en ella no está correctamente saneado y un usuario puede introducir rutas relativas como ../../../../../../../../../../usr/share/icons/hicolor/48x48/apps/gvim.png por medio de herramientas como burpsuite. Más tarde, cuando es exportado un pdf usando el perfil editado, el icono del pdf presenta la imagen en esa ruta (si la imagen está presente). Ambos problemas requieren que un atacante sea capaz de acceder a la interfaz de administración de LAM. El problema ha sido corregido en versión 7.9.1

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-10 CVE Reserved
  • 2022-04-15 CVE Published
  • 2024-07-07 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ldap-account-manager
Search vendor "Ldap-account-manager"
 Ldap Account Manager
Search vendor "Ldap-account-manager" for product "Ldap Account Manager"
 < 7.9.1
Search vendor "Ldap-account-manager" for product "Ldap Account Manager" and version " < 7.9.1"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 11.0
Search vendor "Debian" for product "Debian Linux" and version "11.0"
-
Affected