JDBC JAAS Login Module NULL Password Authentication Bypass

Executive Summary

This vulnerability involves the JDBC-based JAAS login module allowing authentication without a password for accounts with a NULL stored password. A remote attacker who knows the username of such an account can log in and gain its roles. Only systems using this module with NULL passwords in the user table are affected.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses the JDBC-based JAAS login module with NULL passwords in the user table. Review authentication logs for unauthorized access attempts using valid usernames without passwords.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected JAAS login module with NULL passwords in your user table, attackers could impersonate legitimate users by authenticating without a password. This could lead to unauthorized access to sensitive data or system functions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to Apache version 10.3.0 or 11.0.0-M2 to fix the issue. Ensure no user accounts have NULL passwords in the database and enforce password requirements.

Useful 0 Not Useful 0