Summary
A critical PHP code injection vulnerability in GRR allows malicious input from LDAP connector settings to be written into a PHP configuration file.
An administrator who connects GRR to an attacker-controlled LDAP server and submits crafted connector values may enable remote code execution by the application.
A critical PHP code injection vulnerability in GRR allows malicious input from LDAP connector settings to be written into a PHP configuration file.
An administrator who connects GRR to an attacker-controlled LDAP server and submits crafted connector values may enable remote code execution by the application.
Affected context
The issue occurs in GRR deployments that use the LDAP connector and allow an administrator to configure LDAP connection settings through the application interface. Risk is present when connector parameters, such as LDAP filters, are incorporated into the PHP configuration file without sufficient output encoding or validation, particularly after an administrator has connected to an untrusted or attacker-controlled LDAP server.
The issue occurs in GRR deployments that use the LDAP connector and allow an administrator to configure LDAP connection settings through the application interface. Risk is present when connector parameters, such as LDAP filters, are incorporated into the PHP configuration file without sufficient output encoding or validation, particularly after an administrator has connected to an untrusted or attacker-controlled LDAP server.
Exploit preconditions
- Attack surface: GRR's LDAP connector configuration workflow
- Required access: Administrative access to configure or update LDAP connector settings
- Required external condition: The administrator must successfully connect to an LDAP server, which may be attacker-controlled
- Trigger point: Submission of subsequent connector settings containing malicious PHP input
- Why exploitation is possible: User-controlled connector values are written into a PHP configuration file in a form that can later be interpreted as executable PHP code
- Attack surface: GRR's LDAP connector configuration workflow
- Required access: Administrative access to configure or update LDAP connector settings
- Required external condition: The administrator must successfully connect to an LDAP server, which may be attacker-controlled
- Trigger point: Submission of subsequent connector settings containing malicious PHP input
- Why exploitation is possible: User-controlled connector values are written into a PHP configuration file in a form that can later be interpreted as executable PHP code
Why this happens
The vulnerability results from treating LDAP connector configuration data as trusted PHP source code rather than as data.
When values such as LDAP filters are inserted into personnalisation/config_ldap.inc.php without context-appropriate encoding, validation, or safe serialization, an attacker-controlled value can alter the generated PHP file. This behavior maps to CWE-94: Improper Control of Generation of Code, because externally influenced data can affect executable code generated by the application.
The vulnerability results from treating LDAP connector configuration data as trusted PHP source code rather than as data.
When values such as LDAP filters are inserted into personnalisation/config_ldap.inc.php without context-appropriate encoding, validation, or safe serialization, an attacker-controlled value can alter the generated PHP file. This behavior maps to CWE-94: Improper Control of Generation of Code, because externally influenced data can affect executable code generated by the application.
Potential impact
- An attacker may execute arbitrary PHP code in the GRR application context
- The application may be fully compromised
- Confidential reservation or personnel data could be accessed or modified
- Credentials, configuration secrets, or LDAP integration data could be exposed
- The host may be used for persistence, lateral movement, or further attacks
- An attacker may execute arbitrary PHP code in the GRR application context
- The application may be fully compromised
- Confidential reservation or personnel data could be accessed or modified
- Credentials, configuration secrets, or LDAP integration data could be exposed
- The host may be used for persistence, lateral movement, or further attacks
General mitigation guidance
Mitigation generally focuses on ensuring that configuration values remain data and cannot become executable PHP source.
Common defensive patterns include:
- Store connector settings in a data-only format with a safe serializer rather than generating executable PHP
- Apply strict allowlist validation for LDAP parameters and reject unexpected syntax
- Use context-appropriate escaping when values must be embedded in configuration output
- Treat LDAP servers and returned configuration data as untrusted until explicitly verified
- Restrict configuration-writing capabilities to narrowly scoped administrative roles
- Run the application with least privilege and isolate its writable configuration paths
- Prevent the web process from modifying executable application code where operationally feasible
Mitigation generally focuses on ensuring that configuration values remain data and cannot become executable PHP source.
Common defensive patterns include:
- Store connector settings in a data-only format with a safe serializer rather than generating executable PHP
- Apply strict allowlist validation for LDAP parameters and reject unexpected syntax
- Use context-appropriate escaping when values must be embedded in configuration output
- Treat LDAP servers and returned configuration data as untrusted until explicitly verified
- Restrict configuration-writing capabilities to narrowly scoped administrative roles
- Run the application with least privilege and isolate its writable configuration paths
- Prevent the web process from modifying executable application code where operationally feasible
How teams detect issues like this
Detection can include static analysis for concatenation of request or connector values into PHP files, dynamic code-generation APIs, and configuration writers that emit unescaped executable syntax.
Code review should examine LDAP setup workflows, administrator-controlled fields, output encoding, serialization choices, and file permissions on generated configuration files. Runtime monitoring can alert on unexpected changes to personnalisation/config_ldap.inc.php, PHP syntax appearing in configuration values, unusual child processes from the web application, and outbound connections to unapproved LDAP servers. CI policies and automated code-review tools can help flag these patterns before deployment.
Detection can include static analysis for concatenation of request or connector values into PHP files, dynamic code-generation APIs, and configuration writers that emit unescaped executable syntax.
Code review should examine LDAP setup workflows, administrator-controlled fields, output encoding, serialization choices, and file permissions on generated configuration files. Runtime monitoring can alert on unexpected changes to personnalisation/config_ldap.inc.php, PHP syntax appearing in configuration values, unusual child processes from the web application, and outbound connections to unapproved LDAP servers. CI policies and automated code-review tools can help flag these patterns before deployment.
