Summary
A high-severity authentication bypass in Networknt light-4j's BasicAuthHandler can allow unauthenticated attackers to log in as users delegated to LDAP or Active Directory.
The issue occurs when a Basic Authorization header contains a known username with an empty password, causing an unauthenticated LDAP bind to be treated as successful authentication.
A high-severity authentication bypass in Networknt light-4j's BasicAuthHandler can allow unauthenticated attackers to log in as users delegated to LDAP or Active Directory.
The issue occurs when a Basic Authorization header contains a known username with an empty password, causing an unauthenticated LDAP bind to be treated as successful authentication.
Affected context
The vulnerability affects light-4j deployments that:
- Use the BasicAuthHandler for authentication
- Delegate user verification to LDAP or Active Directory
- Accept Basic Authorization credentials containing a known username
- Treat an unauthenticated or anonymous LDAP bind as proof of successful authentication
Deployments using other authentication mechanisms or configurations that reject empty-password authentication may not be exposed to the same condition.
The vulnerability affects light-4j deployments that:
- Use the BasicAuthHandler for authentication
- Delegate user verification to LDAP or Active Directory
- Accept Basic Authorization credentials containing a known username
- Treat an unauthenticated or anonymous LDAP bind as proof of successful authentication
Deployments using other authentication mechanisms or configurations that reject empty-password authentication may not be exposed to the same condition.
Exploit preconditions
- Attack surface: An HTTP endpoint protected by the light-4j BasicAuthHandler
- Required access: Network access to the protected endpoint; valid credentials are not necessarily required
- Trigger point: Processing of a Basic Authorization header containing a recognized username and empty password
- Why exploitation is possible: The authentication flow can accept an unauthenticated LDAP bind as successful validation instead of requiring a verified password
- Attack surface: An HTTP endpoint protected by the light-4j BasicAuthHandler
- Required access: Network access to the protected endpoint; valid credentials are not necessarily required
- Trigger point: Processing of a Basic Authorization header containing a recognized username and empty password
- Why exploitation is possible: The authentication flow can accept an unauthenticated LDAP bind as successful validation instead of requiring a verified password
Why this happens
The underlying bug is an authentication-state validation failure. The BasicAuthHandler permits an LDAP authentication attempt with an empty password to reach an unauthenticated bind and does not reliably distinguish that result from successful user authentication.
This maps to CWE-287: Improper Authentication, because the application accepts an authentication outcome that does not demonstrate possession of the user's valid secret. The insecure pattern is treating directory-service connection success or user lookup success as equivalent to credential verification.
The underlying bug is an authentication-state validation failure. The BasicAuthHandler permits an LDAP authentication attempt with an empty password to reach an unauthenticated bind and does not reliably distinguish that result from successful user authentication.
This maps to CWE-287: Improper Authentication, because the application accepts an authentication outcome that does not demonstrate possession of the user's valid secret. The insecure pattern is treating directory-service connection success or user lookup success as equivalent to credential verification.
Potential impact
- Unauthenticated attackers may access protected endpoints
- Attackers could act as LDAP- or AD-delegated users
- Sensitive data may be exposed through authorized application functions
- Application state or business operations could be modified
- Compromised identities may enable further access based on assigned privileges
- Unauthenticated attackers may access protected endpoints
- Attackers could act as LDAP- or AD-delegated users
- Sensitive data may be exposed through authorized application functions
- Application state or business operations could be modified
- Compromised identities may enable further access based on assigned privileges
General mitigation guidance
Mitigation generally focuses on ensuring that authentication succeeds only after explicit credential verification.
Common defensive patterns include:
- Rejecting empty or missing passwords before invoking directory authentication
- Requiring a positive password-verification result rather than accepting bind or connection success
- Distinguishing anonymous, unauthenticated, and authenticated LDAP sessions
- Applying strict authentication-provider configuration and fail-closed behavior
- Limiting delegated account privileges according to least-privilege principles
- Adding defense-in-depth controls such as authorization checks and monitoring for unusual successful logins
These controls reduce reliance on ambiguous directory-service responses and limit the consequences of an authentication failure.
Mitigation generally focuses on ensuring that authentication succeeds only after explicit credential verification.
Common defensive patterns include:
- Rejecting empty or missing passwords before invoking directory authentication
- Requiring a positive password-verification result rather than accepting bind or connection success
- Distinguishing anonymous, unauthenticated, and authenticated LDAP sessions
- Applying strict authentication-provider configuration and fail-closed behavior
- Limiting delegated account privileges according to least-privilege principles
- Adding defense-in-depth controls such as authorization checks and monitoring for unusual successful logins
These controls reduce reliance on ambiguous directory-service responses and limit the consequences of an authentication failure.
How teams detect issues like this
Organizations can assess for this issue through:
- Static analysis and code review of LDAP bind and Basic Authentication handling
- Tests that verify empty, missing, malformed, and invalid passwords are rejected
- Review of logic that equates directory connection or user lookup success with authentication
- Integration tests covering anonymous and unauthenticated LDAP bind behavior
- Policy checks requiring explicit credential verification and fail-closed authentication
- Runtime monitoring for successful logins with empty credentials or anomalous account usage
Automated security review tools may help identify authentication branches that accept incomplete credentials or ambiguous directory responses.
Organizations can assess for this issue through:
- Static analysis and code review of LDAP bind and Basic Authentication handling
- Tests that verify empty, missing, malformed, and invalid passwords are rejected
- Review of logic that equates directory connection or user lookup success with authentication
- Integration tests covering anonymous and unauthenticated LDAP bind behavior
- Policy checks requiring explicit credential verification and fail-closed authentication
- Runtime monitoring for successful logins with empty credentials or anomalous account usage
Automated security review tools may help identify authentication branches that accept incomplete credentials or ambiguous directory responses.
