Summary
An LDAP search filter injection flaw in 389 Directory Server's CleanAllRUV extended operation allows an unauthenticated remote attacker to influence privileged configuration queries.
By crafting malicious filters, the attacker can cause searches against cn=config and infer sensitive metadata such as replication bind DNs and password storage scheme details based on boolean match responses.
Affected context
This vulnerability occurs in 389 Directory Server environments that expose the CleanAllRUV replication status-check extended operation to remote clients.
The issue is present when user-supplied filter parameters are incorporated into LDAP searches against cn=config using replication plugin privileges.
In these deployments, the operation's boolean response semantics allow an attacker to probe for the existence and properties of internal configuration entries without prior authentication.
Exploit preconditions
- Attack surface: Network-accessible LDAP interface exposing the CleanAllRUV replication status-check extended operation
- Required access: Ability to send unauthenticated LDAP requests to the directory server
- Trigger point: Invocation of the extended operation with attacker-controlled search filters
- Why exploitation is possible: The handler directly uses unvalidated, user-supplied filter components in privileged searches against cn=config and returns match/no-match information, enabling systematic metadata enumeration.
Why this happens
The root cause is improper neutralization of special elements in LDAP search filters, aligning with CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection').
The CleanAllRUV status-check extended operation accepts filter-like input from the client and passes it into a search against cn=config using elevated replication plugin privileges.
Because the filter is not strictly validated or constrained to a safe subset, an attacker can manipulate it to test for the presence or characteristics of sensitive configuration entries.
The boolean-style result exposes whether specific internal attributes or objects match the injected filter, turning the operation into a side-channel for configuration discovery.
Potential impact
- An attacker may discover replication bind distinguished names (DNs) used for inter-server trust.
- An attacker could infer password storage schemes (e.g., hash algorithms, use of reversible encryption) configured on the server.
- An attacker may map portions of the cn=config tree and understand replication topology and plugin configuration.
- An attacker could use leaked metadata to tailor further attacks, such as credential phishing or offline password cracking.
General mitigation guidance
Effective mitigation focuses on constraining how client-provided data is used in LDAP queries and reducing exposure of privileged configuration paths.
Common defensive patterns include:
- Strictly validating and whitelisting allowed filter parameters for extended operations, rejecting any unsupported or complex filter syntax.
- Decoupling client input from direct searches against cn=config by using fixed, server-side queries and pre-defined checks rather than dynamic filters.
- Limiting the scope of privileged operations so they only access non-sensitive metadata necessary for replication status assessment.
- Hardening configuration storage by minimizing the amount of sensitive information exposed in cn=config and segregating high-value secrets where possible.
- Applying least-privilege principles to replication plugins and extended operations, ensuring they do not exceed the minimal access required.
How teams detect issues like this
High-level detection techniques typically involve:
- Static analysis rules that flag code paths where user-supplied filter strings are passed into LDAP search APIs without strict validation or canonicalization.
- Targeted code reviews for extended operations and replication plugins, focusing on any use of cn=config and checking for dynamic query construction.
- Runtime monitoring and logging of extended operation usage, looking for unusual filter patterns, high-frequency probing, or complex search expressions from unauthenticated sources.
- Policy enforcement in development pipelines that requires security review for any new LDAP extended operation or configuration-accessing feature.
- Use of automated security testing tools capable of fuzzing LDAP filters and identifying injection-like behavior or unexpected information disclosure.
