UnboundID LDAP Server Credential Exposure in Spring Security

Executive Summary

Spring Security's embedded UnboundID LDAP server unconditionally registers an administrative credential and binds its listener to all network interfaces. This allows attackers who can access the LDAP port to authenticate using a known administrative bind DN and then read or modify entries in the in-memory directory.

Useful 0 Not Useful 0

Detection Guidance

Check if your Spring Security application uses the embedded UnboundID LDAP server by inspecting configuration files for UnboundIdContainer. Scan network interfaces for open LDAP ports (default 389 or 1389) and verify if administrative credentials are exposed. Use commands like netstat -tuln | grep 389 or ss -tuln | grep 389 to detect listening LDAP ports.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain unauthorized access to sensitive data stored in the LDAP directory or modify entries, potentially leading to data breaches or system compromise. The vulnerability is critical due to its high CVSS score of 9.4, indicating a severe risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using affected versions must address this to maintain compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Spring Security to fixed versions: 7.1.1 (OSS), 7.1.0.1 (Enterprise), 7.0.7 (OSS), 7.0.6.1 (Enterprise), 6.5.12 (Enterprise), 6.4.19 (Enterprise), 5.8.28 (Enterprise), or 5.7.26 (Enterprise). No additional mitigation steps are required beyond upgrading.

Useful 0 Not Useful 0