LDAP Injection: How was it exploited in Joomla attacks?

What is the vulnerability and how could it be exploited in an attack?

Joomla is a popular content management system that powers almost 3% of all websites on the internet and has been downloaded over 84 million times. A static analysis organization called Rips Technologies recently discovered that it is vulnerable to an LDAP injection vulnerability. This vulnerability has existed in his Joomla code for over eight years and the company recently released a patch for their web application to fix a blind LDAP injection.

This type of attack is carried out using the login page of a site that uses LDAP for authentication, exploiting entries inserted into software to attempt to extract, view, or modify data or applications. intrusion is possible.

LDAP injection attacks, especially blind ones like the one Joomla was vulnerable to, aim to exploit the authentication process of passing credentials to the controller, as LDAP servers store users’ usernames and passwords in databases. increase. This particular vulnerability lacks sanitation entirely, allowing an attacker script to rotate attempts through login fields and slowly extract user credentials. This is the blind part of the injection and is usually intended for admins. Get an account and have full access to your Joomla control panel.

This vulnerability could allow an attacker to submit an LDAP injection of query syntax to a login form to slowly gain access to the LDAP database one bit at a time. Once the scripted attack is executed, it can quickly send multiple login attempts and process every possible character in the credential until finally perfecting the password. It’s scripted and intended for the system’s login form so it can quickly navigate her Joomla system which uses her LDAP for authentication.

Not many Joomla servers use LDAP for authentication, but there’s a good chance it’s being used somewhere. LDAP is often used for authentication.

The first thing you should do is check if your site is vulnerable. Users running Joomla versions 1.5 through 3.7.5 are vulnerable when using her LDAP authentication on unpatched sites. However, a patch has been released that specifically addresses this issue and can be installed to mitigate this vulnerability.

Using these plugins for authentication naturally brings up the topic of using multi-factor authentication. Authentication architectures should not rely on systems that use single-factor authentication for applications, especially public applications. This process limits the risk of vulnerabilities and data leaks that could expose data credentials to attackers.

Ask the Experts:
Want to ask Matt Pascucci a question about security? Submit your question now on mail. (Questions are anonymous.)