CVE-2021-36152
📋 TL;DR
Apache Gobblin versions <=0.15.0 trust all certificates for LDAP connections in Gobblin-as-a-Service, disabling TLS certificate validation. This allows man-in-the-middle attackers to intercept and potentially manipulate LDAP traffic. All users running affected versions of Gobblin-as-a-Service are vulnerable.
💻 Affected Systems
- Apache Gobblin
📦 What is this software?
Gobblin by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept LDAP authentication traffic, steal credentials, impersonate users, or inject malicious data into LDAP communications, potentially leading to full system compromise.
Likely Case
Credential theft through LDAP interception, allowing unauthorized access to Gobblin-as-a-Service and potentially downstream systems.
If Mitigated
If proper network segmentation and monitoring are in place, impact may be limited to credential exposure without lateral movement.
🎯 Exploit Status
Exploitation requires network access to intercept LDAP traffic between Gobblin and LDAP server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.16.0
Vendor Advisory: https://lists.apache.org/thread/3bxf7rbf4zh95r78jtgth6gwhr5fyl2j
Restart Required: Yes
Instructions:
1. Download Apache Gobblin 0.16.0 or later from official Apache repository. 2. Stop Gobblin-as-a-Service. 3. Replace existing installation with patched version. 4. Restart Gobblin-as-a-Service.
🔧 Temporary Workarounds
Disable LDAP authentication
allTemporarily disable LDAP authentication in Gobblin-as-a-Service configuration
Edit configuration file to use alternative authentication method or disable authentication
Network segmentation
allIsolate Gobblin-as-a-Service and LDAP server on protected network segment
🧯 If You Can't Patch
- Implement strict network controls between Gobblin-as-a-Service and LDAP server
- Monitor LDAP traffic for anomalies and potential interception attempts
🔍 How to Verify
Check if Vulnerable:
Check Gobblin version: grep 'gobblin.version' in configuration files or run 'gobblin --version' if availableCheck Version:
grep -i version /path/to/gobblin/config/*.properties 2>/dev/null || find / -name '*gobblin*' -type f -exec grep -l 'version' {} \; 2>/dev/nullVerify Fix Applied:
Confirm version is 0.16.0 or higher and verify LDAP connections now validate certificates📡 Detection & Monitoring
Log Indicators:
- LDAP connection failures after patch
- Certificate validation errors in logs
Network Indicators:
- Unencrypted or suspicious LDAP traffic patterns
- Unexpected LDAP connections
SIEM Query:
source="gobblin" AND (event="ldap_connection" OR event="authentication")