Vulnerability · Published Apr 11, 2022 · Assigned by GitHub_M

CVE-2022-24832Bundled ldap-authentication-plugin fails to neutralise LDAP special elements in usernames

High 8.2

In plain English

A high-severity injection in gocd from gocd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)1.7%top 22.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it can allow an existing LDAP-authenticated GoCD user with malicious intent to construct and execute malicious queries, allowing them to deduce facts about other users or entries within the LDAP database (e.g alternate fields, usernames, hashed passwords etc) through brute force mechanisms. This only affects users who have a working LDAP authorization configuration enabled on their GoCD server, and only is exploitable by users authenticating using such an LDAP configuration. This issue has been fixed in GoCD 22.1.0, which is bundled with gocd-ldap-authentication-plugin v2.2.0-144.

Affected products (as reported)

Vendor	Product	Versions
gocd	gocd	>= 17.5.0, < 22.1.0

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

References

https://github.com/gocd/gocd/security/advisories/GHSA-x5v3-x9qj-mh3h x_refsource_CONFIRM
https://github.com/gocd/gocd/pull/10244 x_refsource_MISC
https://github.com/gocd/gocd-ldap-authentication-plugin/commit/87fa7dac5d899b3960ab48e151881da4793cfcc3 x_refsource_MISC
https://docs.gocd.org/22.1.0/configuration/dev_authentication.html#ldapad-authentication x_refsource_MISC
https://github.com/gocd/gocd-ldap-authentication-plugin x_refsource_MISC
https://github.com/gocd/gocd-ldap-authentication-plugin/releases/tag/v2.2.0-144 x_refsource_MISC
https://github.com/gocd/gocd/releases/tag/22.1.0 x_refsource_MISC
https://www.gocd.org/releases/#22-1-0 x_refsource_MISC