PT-2020-6774 · Unknown · Lemonldap::Ng+1

Maxime Besson · Published 2020-08-20 · Updated 2020-09-18 · CVE-2020-24660

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LemonLDAP::NG versions through 2.0.8 Lemonldap::NG handler for Node.js versions before 0.5.2

Description An issue in LemonLDAP::NG allows an attacker to bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This is related to errors in security mechanisms, which can allow a remote attacker to gain unauthorized access to information. When access rules are used inside a protected host, some URL encodings may bypass the filtering system.

Recommendations For LemonLDAP::NG versions through 2.0.8, update to a version that includes the patch for this issue. For Lemonldap::NG handler for Node.js versions before 0.5.2, update to version 0.5.2 or later, which includes a patch that fixes the vulnerability. As a temporary workaround, consider restricting access to protected Virtual Hosts until a patch is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-425

CWE-287

Related Identifiers

BDU:2022-06254

CVE-2020-24660

DLA-2367-1

DSA-4762-1

GHSA-X44X-R84W-8V67

Affected Products

Lemonldap::Ng

Lemonldap::Ng Handler For Node.Js

References · 19

• 🔥 https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2020-24660 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24660 · Security Note
• https://osv.dev/vulnerability/CVE-2020-24660 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06254 · Security Note
• https://osv.dev/vulnerability/DSA-4762-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-24660 · Vendor Advisory
• https://debian.org/security/2020/dsa-4762 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-24660 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x44x-r84w-8v67 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-24660 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-24660 · Security Note
• https://osv.dev/vulnerability/DLA-2367-1 · Vendor Advisory
• https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/security/advisories/GHSA-x44x-r84w-8v67 · Note
• https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/releases/tag/0.5.2 · Note