Listen to this Post
The CVE-2024-3596 vulnerability exploits Moonraker’s LDAP integration when enabled. Attackers target the login endpoint with malicious payloads to inject search filters into LDAP queries. By submitting crafted username parameters containing special LDAP characters like parentheses and asterisks, the input is improperly concatenated into the search filter without sanitization. This allows the attacker to append additional conditions to the original query. The server’s 401 Unauthorized error responses differ based on whether the injected search returns results or not. These differential responses act as an oracle, enabling blind injection attacks. An attacker can systematically brute-force search criteria by observing the presence or absence of the 401 error. For example, injecting “(uid=)” can test for valid user entries. By iterating through possible values, the attacker can enumerate valid user IDs, email addresses, or other LDAP attributes stored on the server. This is possible because the error message reveals whether the LDAP search succeeded internally. The vulnerability requires no prior authentication and can be performed remotely against the Moonraker API. It fundamentally stems from a lack of input validation and proper escaping of user-supplied data in the LDAP filter construction.
Platform: Moonraker
Version: Before 0.10.0
Vulnerability: LDAP filter injection
Severity: Critical
Date: 2024-04-10
Prediction: Patched 0.10.0
What Undercode Say:
Analytics
curl -s http://$HOST:7125/printer/info | grep ldap
curl -X POST http://$HOST:7125/login -d ‘{“username”:”)(uid=))”}’ -H “Content-Type: application/json”
python3 -c “import ldap3; server = ldap3.Server(‘ldap://localhost’); conn = ldap3.Connection(server, auto_bind=True); print(conn.search(‘dc=example,dc=com’, ‘(objectClass=)’))”
cat moonraker.conf | grep -A5 ‘\[ldap\]’
How Exploit:
Send POST requests to /login endpoint with username parameter containing LDAP filter injection payloads (e.g., )(cn=)). Analyze HTTP 401 response variations to infer valid LDAP entries. Use automated tools to brute-force attribute values.
Protection from this CVE
Upgrade to Moonraker 0.10.0. Remove [bash] section from moonraker.conf. Configure max_login_attempts in authorization. Implement network ACLs.
Impact:
LDAP information disclosure. User enumeration. Attribute leakage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
