LDAP Injection in Finsys Dockhand

Executive Summary

This vulnerability is an LDAP injection flaw in the Finsys Dockhand application (versions up to 1.0.18). It occurs in the tryLdapAuth function where the login username is inserted into an LDAP search filter without escaping wildcard characters. Attackers can exploit this by submitting incremental wildcard patterns like 'a*' to the login endpoint and measuring response timing to enumerate valid LDAP usernames while bypassing rate limiting.

Useful 0 Not Useful 0

Detection Guidance

To detect this LDAP injection vulnerability, monitor login attempts to /api/auth/login for incremental wildcard patterns like 'a*', 'b*', etc. Check for unusual timing differences in responses where failed attempts return faster than successful ones. Inspect logs for repeated LDAP queries with unsanitized wildcards in the username field.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this to identify valid usernames in the system, which may aid further attacks like brute force or social engineering. The vulnerability allows remote unauthenticated access to enumerate usernames through timing differences in authentication responses.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Dockhand to version 1.0.19 or later to patch the LDAP injection flaw. Implement input validation to sanitize wildcard characters in usernames before LDAP queries. Add rate limiting based on IP addresses instead of usernames to prevent enumeration attempts.

Useful 0 Not Useful 0