id: CVE-2021-29156

info:
  name: LDAP Injection In OpenAM
  author: melbadry9,xelkomy
  severity: high
  description: OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an
    LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration can allow for full password retrieval.
  reference:
    - https://github.com/sullo/advisory-archives/blob/master/Forgerock_OpenAM_LDAP_injection.md https://hackerone.com/reports/1278050 https://www.guidepointsecurity.com/blog/ldap-injection-in-forgerock-openam-exploiting-cve-2021-29156/
      https://portswigger.net/research/hidden-oauth-attack-vectors
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-29156
    cwe-id: CWE-74
  remediation: Upgrade to OpenAM commercial version 13.5.1 or later.
  tags: cve,cve2021,openam,ldap,injection

requests:
  - method: GET
    path:
      - "{{BaseURL}}/openam/ui/PWResetUserValidation"
      - "{{BaseURL}}/OpenAM-11.0.0/ui/PWResetUserValidation"
      - "{{BaseURL}}/ui/PWResetUserValidation"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "jato.pageSession") && status_code==200'

# Enhanced by cs on 2022/01/24