id: CVE-2021-29156 info: name: LDAP Injection In OpenAM author: melbadry9,xelkomy severity: high description: OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration can allow for full password retrieval. reference: - https://github.com/sullo/advisory-archives/blob/master/Forgerock_OpenAM_LDAP_injection.md https://hackerone.com/reports/1278050 https://www.guidepointsecurity.com/blog/ldap-injection-in-forgerock-openam-exploiting-cve-2021-29156/ https://portswigger.net/research/hidden-oauth-attack-vectors - https://portswigger.net/research/hidden-oauth-attack-vectors - https://bugster.forgerock.org/jira/browse/OPENAM-10135 remediation: Upgrade to OpenAM commercial version 13.5.1 or later. classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2021-29156 cwe-id: CWE-74 epss-score: 0.35656 cpe: cpe:2.3:a:forgerock:openam:*:*:*:*:*:*:*:* metadata: max-request: 3 shodan-query: http.title:"OpenAM" vendor: forgerock product: openam tags: cve,cve2021,openam,ldap,injection http: - method: GET path: - "{{BaseURL}}/openam/ui/PWResetUserValidation" - "{{BaseURL}}/OpenAM-11.0.0/ui/PWResetUserValidation" - "{{BaseURL}}/ui/PWResetUserValidation" matchers: - type: dsl dsl: - 'contains(body, "jato.pageSession") && status_code==200'