| Title | LDAP Injection In OpenAM |
|---|---|
| Author | melbadry9,xelkomy |
| Severity | High |
| Impact | Allows an attacker to execute arbitrary LDAP queries and potentially gain unauthorized access to sensitive information or perform unauthorized actions |
| Remediation | Upgrade to OpenAM commercial version 13.5.1 or later. |
| CVSS Score | 7.5 |
| EPSS Score | 0.88035 |
| CVE ID | CVE-2021-29156 |
| CWE ID | CWE-74 |
| Shodan Query | http.title:"OpenAM"http.title:"openam" |
| Fofa Query | title="openam" |
| Tags | cve2021 cve openam ldap injection forgerock vuln |
OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user’s email. Enumeration can allow for full password retrieval.
GET /openam/ui/PWResetUserValidation HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /OpenAM-11.0.0/ui/PWResetUserValidation HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6,2 Safari/605.1.15
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
GET /ui/PWResetUserValidation HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-29156.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-29156.pcap
N/AN/A