CVE-2021-46823

Python-ldap < 3.4.0 vulnerable to ReDoS in LDAP schema parser

• CVSS 6.5
• CWE-1333
• Input Validation and Sanitization
• Remote

python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.

CVE

CVE-2021-46823

CWE

CWE-1333

CVSS base score

6.5

Published

2022-06-18

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update python-ldap to version 3.4.0 or higher.

import re
from ldap.schema import SchemaParser

class SchemaParser(SchemaParser):
    def parse(self, schema_string):
        super().parse(schema_string)

schema_string = "(a|b|c|d|e|f|g|h|i|j|k|l|m|n|o|p|q|r|s|t|u|v|w|x|y|z)*"

parser = SchemaParser()
parser.parse(schema_string)

import re
from ldap.schema import Schema, SchemaParser

SAFE_REGEX_PATTERN = r'^[a-zA-Z0-9_]+$'

class SchemaParser(SchemaParser):
    def parse(self, schema_string):
        if not re.match(SAFE_REGEX_PATTERN, schema_string):
            raise ValueError("Un schema definition provided.")
        super().parse(schema_string)

schema_string = "(a|b|c|d|e|f|g|h|i|j|k|l|m|n|o|p|q|r|s|t|u|v|w|x|y|z)*"
parser = SchemaParser()
parser.parse(schema_string)

@misc{vaitp:cve202146823,
  title        = {{Python-ldap < 3.4.0 vulnerable to ReDoS in LDAP schema parser}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2021-46823},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-46823/}}
}