CVE-2020-9495 PoC

CVE-2020-9495 is medium severity LDAP injection vulnerability in Apache Archiva versions before 2.2.5. It allows an attacker to retrieve any LDAP attribute values of users that exist on the LDAP server.

From the official Apache Archiva advisory:

By providing special values to the archiva login form a attacker is able to retrieve user attribute data from the connected LDAP server. With certain characters it is possible to modify the LDAP filter used to query the users on the connected LDAP server. By measuring the response time, arbitrary attribute data can be retrieved from LDAP user objects.

PoC

The poc.py script demonstrates how an unauthorized attacker can enumerate users on LDAP server integrated with Archiva and fetch the value of any attribute of any user.

Local Archiva test server

Skip this step if you already have an Archiva server with enabled LDAP authentication.

1. Download Archiva 2.2.4 and extract it

   root@kitploit:~

   $ wget https://archive.apache.org/dist/archiva/2.2.4/binaries/apache-archiva-2.2.4-bin.tar.gz
   $ tar -zxf apache-archiva-2.2.4-bin.tar.gz
   
   

2. Run OpenLDAP server

   root@kitploit:~

   $ docker run -p 2389:389 --name my-openldap-container osixia/openldap:1.3.0