CVE-2021-29156
HIGH NUCLEIForgeRock OpenAM < 13.5.1 - Unauthenticated LDAP Injection via Webfinger Protocol
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2021-29156. PoCs published by Charlton Trezevant, guidepointsecurity, 5amu. A Nuclei detection template is also available.
AI-analyzed exploit summary This Go-based exploit demonstrates LDAP injection in OpenAM 13.0 via brute-forcing character-by-character to extract password hashes. It uses HTTP requests with crafted payloads to test for valid characters in the hash.
Description
ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.
Exploits (3)
This Go-based exploit demonstrates LDAP injection in OpenAM 13.0 via brute-forcing character-by-character to extract password hashes. It uses HTTP requests with crafted payloads to test for valid characters in the hash.
This repository contains a functional Go-based proof-of-concept exploit for CVE-2021-29156, an LDAP injection vulnerability in ForgeRock OpenAM v13.0.0. The exploit performs a character-by-character brute force attack to extract user password hashes via crafted LDAP queries.
This repository contains a functional Go-based exploit for CVE-2021-29156, an LDAP injection vulnerability in OpenAM. The tool performs a brute-force attack to recover user passwords by leveraging a timing-based side-channel in the WebFinger endpoint.
Nuclei Templates (1)
http.title:"OpenAM" || http.title:"openam"
title="openam"
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N