LDAPMon

LDAPMon LDAPMon 是 Microsoft-Windows-LDAP-Client ETW 提供程序的一个 POC 遥测收集器。启动后，日志将存储在事件查看器中。该 POC 附带一个 Sentinel 解析器，因此如果您想在 SIEM 中收集这些数据，可以这样做。最好在 Sysmon 旁边运行。 安装 以管理员身份打开 cmd 或 PowerShell 提示符。 运行 LDAPMon.exe。 不要关闭 LDAPMon 窗口。 如果一切成功，您将看到以下内容： .\LDAPMonitor.exe Uninstalling Manifest.... Manifest...

CVE-2024-49112

LDAP Nightmare 针对由 Yuki Chen（@guhe120）报告的 CVE-2024-49112 的漏洞利用工具。这是 Windows 轻量目录访问协议（LDAP）中的一个漏洞。 由 SafeBreach Labs 创建（发布于 2025 年 1 月 1 日）。有关该漏洞的完整技术分析以及我们如何成功利用它的详细信息，请查看博客文章 此处 概述 CVE-2024-49112 是 Windows LDAP 客户端中的一个严重漏洞，根据 Microsoft 的说法，该漏洞允许远程代码执行。此漏洞利用工具通过与该漏洞交互目标 Windows Server 系统的 Netlogo...

ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...

cve-2024-49113-ldap_nightmare_reproduction

CVE-2024-49113 — LDAP Nightmare Windows LDAP 客户端远程代码执行（基于堆的缓冲区溢出） 字段| 值 ---|--- CVE| CVE-2024-49113 别名| LDAP Nightmare CVSS 3.1| 9.8 — 严重 CWE| CWE-122 — 基于堆的缓冲区溢出 发现| SafeBreach（2025 年 1 月发布 PoC） 利用状态| 已确认在野主动利用 补丁| Microsoft 2024 年 12 月 Patch Tuesday（KB5048685 / KB5048652） 1. 概述 CVE-2024-49113 是...

metasploit-ldapnightmare

metasploit-ldapnightmare SafeBreachesのCVE-2024-49113 POC（LdapNightmare）をMetasploitに統合 概要 このモジュールは、Windows LDAPクライアントの重大な脆弱性であるCVE-2024-49113を実装し、システムの不安定性を引き起こす可能性があります。このモジュールはMetasploit Frameworkと統合され、この脆弱性に対するシステムの耐性をテストする信頼性の高い方法を提供します。 特徴 完全なMetasploit Framework統合 非同期LDAPサーバーの実装...

ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI

A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the underlying directory server's ACI...

CLEANSTART-2026-EU32419 It was identified that the LDAP client implementation in version 2

Security vulnerability affects the keycloak package. It was identified that the LDAP client implementation in version 2...

389-ds-base: 389-ds: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

EUVD-2026-72400

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

CVE-2026-76560

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated...

CVE-2026-76578

FreeIPA is affected by a critical flaw (CVSS 9.8 ) in its self-managed OTP token ACI , which does not require authentication and fails to restrict which attributes may be added alongside a token entry. Combined with a related flaw in the underlying directory server's ACI evaluation (tracked separ...

Linux Distros Unpatched Vulnerability : CVE-2026-76578

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the...

Exploit for Out-of-bounds Read in Microsoft

CVE-2024-49113 — LDAP Nightmare Windows LDAP Client Remote...

CVE-2026-57962: Uncontrolled Resource Consumption

A malicious LDAP server, which a Thunderbird user is configured to query for address-book autocomplete, can stash arbitrarily large amounts of attacker-supplied data into the Thunderbird LDAP client until it crashes due to memory exhaustion. This vulnerability was fixed in Thunderbird 152.0.1 and...

Improper Certificate Validation

The LDAP client is vulnerable to Improper Certificate Validation. The vulnerability is due to missing hostname verification during TLS server identity validation, where the LDAP client validates the certificate chain but does not verify that the certificate matches the intended LDAP server...

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP

cve-2026-41720 - HIGH - Authentication Bypass with Empty Password in Spring LDAP...

CVE-2026-35563

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid...

EUVD-2026-33569

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid...

CVE-2026-35563 Apache Directory LDAP API: LDAP client implementation does not verify if the server certificate matches the intended LDAP hostname

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid...

CVE-2026-35563: Improper Validation of Certificate with Host Mismatch

It was identified that the LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. While the underlying code validates the certificate chain against a trusted authority, the absence of endpoint identification allows a valid...