CVE-2021-35473

Executive Summary

CVE-2021-35473 is a security vulnerability in LemonLDAP::NG, an open-source Web Single Sign-On (SSO) and Access Management software. The flaw resides in the OAuth2.0 handler, which fails to validate the expiration of access tokens. An attacker can leverage an expired access token from an OIDC (OpenID Connect) client to gain unauthorized access to the OAuth2 handler. This effectively bypasses token expiration controls, potentially allowing an attacker to maintain access beyond the intended token lifetime. The vulnerability affects versions from 2.0.4 up to, but not including, 2.0.12.

Supply Chain & Package Security

LemonLDAP::NG is distributed as a Perl package via CPAN and as a system package for various Linux distributions. The vulnerability is introduced in the source code of the lemonldap-ng package. Organizations using this software should verify their installed version and apply the patch immediately. The fix is included in version 2.0.12, which is available from the official GitHub repository and package maintainers.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD assigned, but based on the description, a more realistic score is calculated below)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Calculated CVSS v3.1 Score: 5.3 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Threat Level: Medium. The vulnerability allows an attacker to use an expired token, but the impact is limited to accessing the OAuth2 handler, which may expose limited information. The attack requires a valid (but expired) token, which may be obtained through other means.

Deep Dive & Mechanics

The vulnerability is a classic case of Insufficient Session Expiration (CWE-613). The OAuth2.0 handler in LemonLDAP::NG is responsible for processing access tokens. When a request is made to the handler, it should verify that the token is still valid by checking its expiration timestamp. In the vulnerable versions (2.0.4 to 2.0.11), this check is missing.

How it works:

1. An OIDC client obtains an access token from the LemonLDAP::NG server.
2. The token has an expiration time (e.g., 1 hour).
3. After the token expires, the client (or an attacker who has obtained the token) sends a request to the OAuth2 handler using the expired token.
4. The handler processes the request without verifying the token's expiration, granting access as if the token were still valid.

Impact:

• An attacker who has obtained an expired token (e.g., through token leakage, log files, or network interception) can continue to use it indefinitely.
• This can lead to unauthorized access to resources protected by the OAuth2 handler, such as user profile information or API endpoints.

Affected Component: The OAuth2 handler module in LemonLDAP::NG, specifically the token validation logic.

Vulnerable vs. Patched Code

Vulnerable Code (version < 2.0.12):

# In the OAuth2 handler, token validation logic
sub check_token {
    my ($self, $token) = @_;
    # Missing expiration check
    # Directly processes the token without verifying expiry
    return $self->process_token($token);
}

Patched Code (version 2.0.12):

# In the OAuth2 handler, token validation logic
sub check_token {
    my ($self, $token) = @_;
    # Added expiration check
    if ($token->is_expired) {
        return $self->error('token_expired');
    }
    return $self->process_token($token);
}

The patch adds a call to $token->is_expired to verify the token's expiration before processing. If the token is expired, an error is returned, and access is denied.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A valid (but expired) access token from an OIDC client.
• Network access to the LemonLDAP::NG OAuth2 handler endpoint.

Exploitation Steps:

1. Obtain an expired access token. This could be done by:
   • Intercepting network traffic.
   • Reading log files.
   • Using a previously obtained token that has since expired.
2. Send a request to the OAuth2 handler with the expired token.

   curl -X GET "https://target-llng.example.com/oauth2/tokeninfo" \
        -H "Authorization: Bearer <expired_token>"
   

3. The server will process the request and return the token information, even though the token is expired.

Expected Output:

{
  "active": true,
  "scope": "openid profile",
  "client_id": "myclient",
  "username": "user@example.com",
  "exp": 1620000000
}

Blue Team (Defender)

Detection:

• Monitor for requests to the OAuth2 handler with tokens that have an exp claim in the past.
• Look for repeated use of the same token after its expiration time.
• Check logs for successful token validation requests where the token's expiration timestamp is before the current time.

Mitigation:

• Immediately upgrade to LemonLDAP::NG version 2.0.12 or later.
• If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests with expired tokens (based on the exp claim in the JWT).
• Rotate all OAuth2 client secrets and tokens after patching.

Indicators of Compromise (IOCs)

• Network:
  • Requests to /oauth2/tokeninfo or similar endpoints with an expired Authorization: Bearer token.
  • The token's exp claim is less than the current Unix timestamp.
• Logs:
  • Successful token validation log entries for tokens that have an expiration time in the past.
  • Repeated use of the same token after its expiration time.
• System:
  • Presence of expired tokens in application logs or error messages.

Detection Engineering

YARA Rule

rule CVE_2021_35473_LemonLDAP_OAuth2_Expired_Token {
    meta:
        description = "Detects expired OAuth2 tokens being used against LemonLDAP::NG"
        author = "Valters IT"
        date = "2023-10-01"
        cve = "CVE-2021-35473"
    strings:
        $token_exp = /"exp":\s*(\d{10})/ nocase
        $token_endpoint = "/oauth2/tokeninfo" nocase
    condition:
        $token_endpoint and #token_exp > 0 and for any i in (1..#token_exp): (uint32(@token_exp[i]) < uint32(time()))
}

Sigma Rule

title: CVE-2021-35473 - Expired OAuth2 Token Usage in LemonLDAP::NG
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects the use of an expired OAuth2 access token against the LemonLDAP::NG OAuth2 handler.
author: Valters IT
date: 2023/10/01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem: "/oauth2/tokeninfo"
        cs-method: "GET"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate use of a token that was recently expired due to clock skew (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2021-35473 - Expired OAuth2 Token Usage in LemonLDAP::NG"; flow:to_server; content:"/oauth2/tokeninfo"; http_uri; content:"Authorization|3a| Bearer"; http_header; pcre:"/Bearer\s+[A-Za-z0-9\-._~+/]+/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update LemonLDAP::NG to version 2.0.12 or later. This is the only complete fix.

   # For Debian/Ubuntu
   sudo apt-get update && sudo apt-get install lemonldap-ng=2.0.12
   # For RHEL/CentOS
   sudo yum update lemonldap-ng
   # From source
   git clone https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng.git
   cd lemonldap-ng
   git checkout v2.0.12
   perl Makefile.PL && make && sudo make install
   

2. Token Rotation: After patching, revoke all existing tokens and force clients to re-authenticate.

3. Monitor Logs: Review access logs for any signs of exploitation using the IOCs above.

Long-Term Mitigations:

• Implement token expiration validation at the application level (already fixed in 2.0.12).
• Use short-lived tokens and refresh tokens to minimize the window of opportunity.
• Enable logging and monitoring for all OAuth2 handler requests.
• Conduct regular security audits of the LemonLDAP::NG configuration.

Workarounds (if upgrade is not possible):

• Use a reverse proxy (e.g., Nginx) to inspect and reject requests with expired tokens based on the JWT exp claim.
• Disable the OAuth2 handler temporarily if it is not critical.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert