Go Ldap Admin
Monthly
Cleartext LDAP credential recovery in go-ldap-admin through 0.6.2 is possible because the application ships with a hard-coded RSA private key, committed to the public repository at config/config.go, that is used to encrypt login passwords. An attacker who obtains the encrypted password blobs - by capturing login traffic or reading a stored encrypted value - can decrypt them offline, or simply replay them to the unauthenticated /base/decryptpwd endpoint, to recover usable LDAP account credentials; no authentication, user interaction, or non-default configuration is required once ciphertext is in hand, which is the only real precondition (reflected in the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N versus the vendor-provided CVSS 4.0 score of 8.2). Deployments that replaced the embedded key with their own keypair are not affected. No vendor patch is identified in the available data, and no public exploit code has been flagged at time of analysis, although a detailed public technical writeup of the decrypt oracle exists.
Cleartext LDAP credential recovery in go-ldap-admin through 0.6.2 is possible because the application ships with a hard-coded RSA private key, committed to the public repository at config/config.go, that is used to encrypt login passwords. An attacker who obtains the encrypted password blobs - by capturing login traffic or reading a stored encrypted value - can decrypt them offline, or simply replay them to the unauthenticated /base/decryptpwd endpoint, to recover usable LDAP account credentials; no authentication, user interaction, or non-default configuration is required once ciphertext is in hand, which is the only real precondition (reflected in the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N versus the vendor-provided CVSS 4.0 score of 8.2). Deployments that replaced the embedded key with their own keypair are not affected. No vendor patch is identified in the available data, and no public exploit code has been flagged at time of analysis, although a detailed public technical writeup of the decrypt oracle exists.