CVE-2019-19791
📋 TL;DR
This vulnerability in LemonLDAP::NG allows attackers to bypass authentication by manipulating URLs to access SOAP/REST endpoints that should be restricted. It affects systems using default Apache HTTP Server configurations with certain LemonLDAP::NG setup options. The bypass occurs when attackers insert 'index.fcgi/index.fcgi' into URLs to circumvent Require directives.
💻 Affected Systems
- LemonLDAP::NG (lemonldap-ng)
📦 What is this software?
Lemonldap\ by Lemonldap Ng
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized access to protected resources, potentially leading to data theft, privilege escalation, or full system compromise.
Likely Case
Unauthorized access to sensitive endpoints and protected resources that should require authentication.
If Mitigated
No impact if proper access controls and updated configurations are implemented.
🎯 Exploit Status
Exploitation requires knowledge of specific URL manipulation technique but is straightforward once understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.7
Vendor Advisory: https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-0-7-is-out
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Upgrade LemonLDAP::NG to version 2.0.7 or later. 3. Restart Apache HTTP Server. 4. Verify the fix by testing authentication bypass attempts.
🔧 Temporary Workarounds
Manual Apache Configuration Update
linuxModify Apache configuration to properly restrict access to SOAP/REST endpoints
Edit Apache configuration files to add proper Require directives and LocationMatch blocks for all SOAP/REST endpoints
🧯 If You Can't Patch
- Implement network segmentation to isolate vulnerable systems from untrusted networks
- Deploy web application firewall (WAF) rules to detect and block URL manipulation attempts
🔍 How to Verify
Check if Vulnerable:
Check if running LemonLDAP::NG version earlier than 2.0.7 and using default Apache configuration with SOAP/REST endpointsCheck Version:
lemonldap-ng-cli --version or check package manager (apt list --installed | grep lemonldap-ng)Verify Fix Applied:
Test authentication bypass by attempting to access protected endpoints with 'index.fcgi/index.fcgi' inserted in URLs📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to SOAP/REST endpoints
- Failed authentication attempts followed by successful access
- URLs containing 'index.fcgi/index.fcgi' pattern
Network Indicators:
- HTTP requests with manipulated URLs containing duplicate path elements
- Access to protected endpoints without proper authentication headers
SIEM Query:
source="apache_access.log" AND (url="*index.fcgi/index.fcgi*" OR status=200 AND url="*/soap/*" OR url="*/rest/*")