Org.openidentityplatform.opendj:opendj server legacy: OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check
Affects org.openidentityplatform.opendj:opendj-server-legacySource GCVE Database
- Patch
- Available – fixed in 5.1.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Mavenorg.openidentityplatform.opendj:opendj-server-legacy | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A fix is available in OpenDJ server legacy version 5.1.2 that enforces the mayProxy scope check on the SASL PLAIN authzid path, aligning it with other proxy authorization mechanisms. Until upgrading, it is recommended to restrict or revoke the proxied-auth privilege to prevent exploitation. No other mitigations are specified.
Description
A vulnerability in OpenDJ server legacy versions prior to 5.1.2 allows an attacker with the proxied-auth privilege to bypass proxy access control checks when using SASL PLAIN authentication with an authorization identity (authzid). This flaw permits privilege escalation by impersonating arbitrary non-root directory users beyond the intended proxy ACI restrictions. The issue arises because the SASL PLAIN authzid path does not enforce the mayProxy scope check, unlike other proxy paths. The vulnerability is critical and can be mitigated by upgrading to version 5.1.2 or later or restricting the proxied-auth privilege until patched.
Impact
An attacker holding the proxied-auth privilege can escalate privileges by impersonating arbitrary directory users beyond the scope intended by proxy ACIs, effectively bypassing authorization controls. This compromises confidentiality and integrity of directory data for affected users. The root or Directory Manager accounts cannot be assumed via this method. The vulnerability does not impact availability.
Summary
OpenDJ server legacy versions before 5.1.2 contain a vulnerability in the SASL PLAIN bind mechanism where supplying an authorization identity (authzid) that resolves to a different user bypasses the proxy access control instruction (ACI) scope check. Specifically, the PlainSASLMechanismHandler verifies only the PROXIED_AUTH privilege but does not evaluate the 'proxy' access-control right (mayProxy ACI scope). Consequently, any account with the proxied-auth privilege can impersonate any resolvable non-root identity without the required proxy ACI grant. This behavior deviates from other proxy paths like DIGEST-MD5 and GSSAPI, which require both privilege and mayProxy scope. The vulnerability enables privilege escalation and authorization bypass, allowing unauthorized impersonation of directory users. The fix involves enforcing the mayProxy scope check on the SASL PLAIN authzid path and returning INVALID_CREDENTIALS before password verification to prevent information leakage. Until patched, restricting or revoking the proxied-auth privilege is recommended.
Weaknesses
References
- github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-p279-2cqp-84jg (opens in a new tab)
- github.com/OpenIdentityPlatform/OpenDJ/commit/5c326850f1ab945cfca7ac9c5aaf77d1052c6bed (opens in a new tab)
- github.com/OpenIdentityPlatform/OpenDJ (opens in a new tab)
- github.com/OpenIdentityPlatform/OpenDJ/releases/tag/5.1.2 (opens in a new tab)