CVE-2022-31086
📋 TL;DR
LDAP Account Manager versions before 8.0 contain a vulnerability where incorrect regular expressions allow uploading PHP scripts to the config/templates/pdf directory. This could lead to remote code execution if that directory is accessible to remote users, though this is not the default configuration. Organizations running vulnerable LAM versions with web-accessible template directories are affected.
💻 Affected Systems
- LDAP Account Manager (LAM)
📦 What is this software?
Ldap Account Manager by Ldap Account Manager
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with full system compromise, allowing attackers to execute arbitrary commands, steal data, or pivot to other systems.
Likely Case
Limited impact since the vulnerable directory is not web-accessible by default; exploitation requires specific misconfigurations.
If Mitigated
No impact if running patched version or if directory access controls prevent remote access to config/templates/pdf.
🎯 Exploit Status
Exploitation requires ability to upload files and web access to the vulnerable directory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.0
Vendor Advisory: https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-q9pc-x84w-982x
Restart Required: Yes
Instructions:
1. Backup current LAM configuration and data. 2. Download LAM version 8.0 or later from official sources. 3. Replace existing installation with new version. 4. Restart web server service. 5. Verify functionality.
🔧 Temporary Workarounds
Restrict directory access
allEnsure config/templates/pdf directory is not accessible via web server
# For Apache: Add to .htaccess or virtual host config
<Directory "/path/to/lam/config/templates/pdf">
Require all denied
</Directory>
# For Nginx: Add to server block
location /lam/config/templates/pdf {
deny all;
return 403;
}
🧯 If You Can't Patch
- Implement strict access controls to prevent web access to config/templates/pdf directory
- Monitor file upload functionality and audit directory permissions regularly
🔍 How to Verify
Check if Vulnerable:
Check LAM version via web interface or by examining installed files; versions below 8.0 are vulnerable if config/templates/pdf is web-accessible.Check Version:
# Check LAM version via web interface or config file
grep 'lamVersion' /path/to/lam/config/lam.confVerify Fix Applied:
Confirm LAM version is 8.0 or higher and test that PHP files cannot be uploaded to config/templates/pdf directory.📡 Detection & Monitoring
Log Indicators:
- File upload attempts to config/templates/pdf directory
- PHP file execution from unusual locations
- Web server access logs showing requests to /lam/config/templates/pdf/
Network Indicators:
- HTTP POST requests with file uploads to LAM endpoints
- Unexpected outbound connections from web server
SIEM Query:
source="web_server_logs" AND (uri="/lam/config/templates/pdf/*" OR uri="*/upload*" AND referer="*lam*")🔗 References
- https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4
- https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-q9pc-x84w-982x
- https://www.debian.org/security/2022/dsa-5177
- https://github.com/LDAPAccountManager/lam/commit/f1d5d04952f39a1b4ea203d3964fa88e1429dfd4
- https://github.com/LDAPAccountManager/lam/security/advisories/GHSA-q9pc-x84w-982x
- https://www.debian.org/security/2022/dsa-5177
