vulnerability with ldap authentication
-
Greg Schueler- State changed from new to open
- Tag set to authentication, bug, ldap
- Milestone set to Rundeck 1.4.3
- Milestone order changed from 124 to 0
analysis: if "forceBindingLogin" is set to true for the JettyCachingLdapLoginModule login module, then after a user logs in successfully there is a failure to verify the user credentials for the duration of the "cacheDurationMillis" for subsequent log ins.
security:
This means that while the user information is cached, the credentials are not checked for subsequent logins for that user.
mitigation:
Either set "forceBindingLogin" to false, or disable the caching behavior to prevent this issue.
To disable the cache: In the jaas login module config file for the JettyCachingLdapLoginModule, set the "cacheDurationMillis" to 0.
fix:
the cache needs to use the user credentials to verify login attempts, not just the username.
-
Greg Schueler
- State changed from open to needs_verification
(from [0b91204303ffb47adee715961467b4fe85eef9a9]) Use digest of user+password as cache key
[#555 vulnerability with ldap authentication state:needs_verification]
require username+password to be valid before
allowing use of cached user info.
https://github.com/dtolabs/rundeck/commit/0b91204303ffb47adee715961... -
Greg Schueler
(from [35b34140896f761749d06dfd32d12863d77152e9]) Use digest of user+password as cache key
[#555 vulnerability with ldap authentication state:needs_verification]
require username+password to be valid before
allowing use of cached user info.
https://github.com/dtolabs/rundeck/commit/35b34140896f761749d06dfd3... -
Greg Schueler
- State changed from needs_verification to resolved
- Milestone order changed from 35 to 0
Please Sign in or create a free account to add a new ticket.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.