CVE-2026-101145

Executive Summary

CVE-2026-101145 is an LDAP injection vulnerability in Eleveo Call Recording Software version 9.7.0, reachable remotely through the User Management component's /callrec/userAddAction.do endpoint via manipulation of the Username argument. The flaw is classified under CWE-74 (Injection) and carries a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), reflecting a low-confidentiality impact gated behind low-privileged authentication. The exploit is publicly available and the vendor did not respond to early disclosure contact, leaving 9.7.0 deployments unpatched as of this report.

Technical Analysis

The vulnerability resides in the User Management component of Eleveo Call Recording Software 9.7.0, specifically the code path handling the /callrec/userAddAction.do file. When the Username argument is supplied to this endpoint, it is incorporated into an LDAP query without adequate neutralization of LDAP metacharacters — the defining condition of CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component, i.e., Injection).

LDAP injection occurs when user-controlled input is concatenated into a directory-service search filter without escaping reserved characters such as *, (, ), \, &, |, and !. In a "user add" workflow, the application typically performs an LDAP lookup (for example, to verify that a proposed username does not already exist, to bind a new account, or to resolve group membership in Active Directory or another LDAP directory). Because the Username value flows into that filter unescaped, an authenticated attacker can modify the logical structure of the search filter, causing the directory query to return different results than the developer intended.

The attack surface is the web-facing .do action handler. The .do extension indicates a Java servlet-style action dispatch — consistent with the Apache Struts or a comparable MVC framework commonly bundled in Java-based telephony and recording platforms. However, the NVD description does not identify the specific framework, class, or method involved; only the endpoint path, component, and parameter are stated verbatim. Analysts should therefore treat the mapping of Username to a specific filter-building routine as an inference from the vulnerability class, not as a confirmed code-level finding.

Critically, the CVSS vector indicates PR:L (low privileges required), meaning the attacker needs at least a valid low-privileged session on the application to reach the vulnerable action. The S:U scope metric means the impact is confined to the vulnerable component's security authority — the LDAP directory query context. C:L (low confidentiality impact) and I:N/A:N indicate the primary demonstrable effect is information disclosure rather than data modification or denial of service. This is consistent with blind or error-based LDAP injection used to enumerate directory objects, users, and attributes accessible to the application's bind account.

The vendor was contacted early regarding the disclosure and did not respond in any way, so no official root-cause analysis, remediation guidance, or patch reference exists. Patch confidence is 0/4.

Exploitation Scenarios

The following chain is derived strictly from the vulnerability class and the details explicitly provided (endpoint /callrec/userAddAction.do, component User Management, argument Username, remote execution, low privilege). No public PoC code is available in the provided data, so the mechanics below are described at the vulnerability-class level; no implementation specifics are invented.

1. Reconnaissance / target identification. An attacker locates an internet- or intranet-exposed Eleveo Call Recording instance running version 9.7.0. Exposed installations can be identified by fingerprinting the /callrec/ application path or the userAddAction.do endpoint. The attacker obtains or already possesses a low-privileged account, since the vector requires PR:L. This could be a legitimate recording-agent or operator credential, a shared service account, or credentials obtained through unrelated means.

2. Triggering the flaw class. The attacker issues a crafted request to the User Management action /callrec/userAddAction.do, supplying a Username value containing LDAP filter metacharacters ((, ), *, &, |, !, \). The application embeds this value into an LDAP search filter — a check that the username is available — without escaping. Classic constructions include injecting a wildcard * to force a match, or injecting a boolean sub-filter such as (username=<payload>) to make the filter evaluate true or false unconditionally.

3. Payload / execution method. At the class level, two outcomes are typical of this injection type:

   • Authentication/logic bypass: making a "username already exists" or availability check evaluate contrary to the developer's intent (e.g., Username=* or an injected )(|(uid=*)) fragment) so the filter matches all or none.
   • Directory enumeration (blind/error-based): injecting boolean sub-conditions to force the directory query to return true/false responses, then iterating character-by-character to recover directory attributes such as usernames, distinguished names, group memberships, or other attributes readable by the application's bind identity. Error-based variants rely on LDAP error strings surfacing in the HTTP response.

   Because only the filter structure — not the underlying query — is attacker-controlled, the achievable effect is bounded by the privileges of the LDAP bind account used by the application.

4. Post-exploitation impact. Successful exploitation yields information disclosure consistent with the C:L rating: enumeration of directory objects and attributes reachable by the application's LDAP context. Enumerated data can support lateral movement (username harvesting, group mapping, locating privileged accounts) and can refine follow-on attacks against the same or federated systems. The vector assigns no integrity or availability impact to this CVE alone, so the immediate effect is reconnaissance-grade disclosure rather than direct account takeover or service disruption.

No evidence of active exploitation, threat-actor association, or CISA KEV listing is present in the provided intelligence. The exploit is described as publicly available, which raises the likelihood of opportunistic use even without a named campaign.

Impact Assessment

• Affected asset: Eleveo Call Recording Software 9.7.0, specifically the User Management component at /callrec/userAddAction.do.
• Attack prerequisites: network reachability to the application (AV:N) and a low-privileged authenticated session (PR:L), with no user interaction required (UI:N) and low attack complexity (AC:L).
• Confidentiality impact (C:L): limited disclosure of information from the LDAP directory accessible to the application's query context. In call-recording environments, directory enumeration may reveal usernames, organizational structure, and group memberships that are sensitive for compliance and privacy reasons.
• Integrity/availability (I:N/A:N): no direct data modification or denial of service attributed to this CVE.
• Scope (S:U): impact stays within the vulnerable component's security authority; the LDAP query context does not pivot to a broader scope per the assigned vector.
• Blast radius: organizations running exposed Eleveo 9.7.0 instances with LDAP-backed authentication or directory integration. Because vendors in the call-recording and compliance space often sit on regulated voice data (PCI, HIPAA, GDPR contexts), even "low" confidentiality disclosure of directory metadata can carry compliance and privacy consequences disproportionate to the numeric CVSS score of 4.3.
• Exploitability context: the exploit is publicly available, and there is no vendor patch, elevating real-world risk above the nominal base score for unpatched, internet-facing deployments.

Detection Guidance

Sigma Rule

title: Eleveo Call Recording LDAP Injection via User Management Username
id: 6b1f0a2c-7d3e-4e5a-9c11-eleveo101145
status: experimental
description: Detects LDAP metacharacters injected into the Username argument of /callrec/userAddAction.do (CVE-2026-101145)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101145
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/callrec/userAddAction.do'
  selection_method:
    cs-method: 'POST'
  selection_payload:
    cs-uri-query|contains:
      - 'Username=*'
      - 'Username=%2a'
      - 'Username=)('
      - 'Username=%29%28'
      - 'Username=(|'
      - 'Username=(&'
      - 'Username=)!(('
  condition: selection_endpoint and selection_method and selection_payload
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate usernames containing unusual characters (rare)
level: high

YARA Rule

rule CVE_2026_101145_LDAPInjection_Eleveo
{
    meta:
        description = "Detects LDAP injection metacharacter patterns targeting Eleveo /callrec/userAddAction.do (CVE-2026-101145)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101145"
        date = "2026"
        severity = "high"

    strings:
        $endpoint = "/callrec/userAddAction.do" ascii nocase
        $param = "Username=" ascii nocase
        $m1 = "Username=*" ascii nocase
        $m2 = "Username=)(" ascii
        $m3 = "Username=(|" ascii
        $m4 = "Username=(&" ascii
        $m5 = "Username=)!((" ascii
        $enc = "Username=%2a" ascii nocase

    condition:
        $endpoint and $param and 1 of ($m*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101145 Eleveo Call Recording LDAP Injection Attempt (userAddAction.do Username)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/callrec/userAddAction.do"; nocase; http.request_body; content:"Username="; nocase; pcre:"/Username=(%2a|\*|\)\()/i"; classtype:web-application-attack; reference:cve,2026-101145; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101145; sid:2026101145; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [http where url.path == "/callrec/userAddAction.do" and http.request.method == "POST"]
  [http where url.path == "/callrec/userAddAction.do" and
     wildcard(http.request.body, "*Username=*") and
     (wildcard(http.request.body, "*Username=*") or
      wildcard(http.request.body, "*Username=)(") or
      wildcard(http.request.body, "*Username=(|") or
      wildcard(http.request.body, "*Username=(&") or
      wildcard(http.request.body, "*Username=%2a"))]

Splunk SPL Query

index=web OR index=proxy sourcetype=access_combined OR sourcetype=stream:http
| search (uri_path="/callrec/userAddAction.do" OR url="/callrec/userAddAction.do" OR cs_uri_stem="/callrec/userAddAction.do")
| search (form_data="*Username=*" OR uri_query="*Username=*" OR cs_uri_query="*Username=*")
| eval suspect_payload=coalesce(form_data, uri_query, cs_uri_query)
| regex suspect_payload="Username=(%2a|\*|\)\()"
| stats count min(_time) as first_seen max(_time) as last_seen values(suspect_payload) as payloads by src_ip, uri_path
| sort -count

Wazuh OSSEC Rule

<group name="web,appsec,">
  <rule id="101145" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>/callrec/userAddAction.do</url>
    <regex>Username=(%2a|\*|\)\()</regex>
    <description>CVE-2026-101145: Possible Eleveo Call Recording LDAP injection attempt on /callrec/userAddAction.do</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_101145,ldap_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). There is no vendor advisory or fixed version. The vendor was contacted early about the disclosure and did not respond.

1. Immediate mitigations

   • Remove or restrict external reachability of /callrec/ and /callrec/userAddAction.do. Place the application behind an authenticated reverse proxy or VPN and allow only trusted management networks. Because the vector requires PR:L, restricting who can authenticate meaningfully shrinks exposure.
   • Apply WAF/IPS rules to block LDAP metacharacters ((, ), *, \, &, |, !) in the Username parameter and in requests to /callrec/userAddAction.do, using the Suricata and Sigma logic above as a starting point.
   • Enforce least privilege on the LDAP service account the application uses to bind and query. Restrict its read scope to only the base DN and attributes it requires, limiting what any successful injection can disclose.
   • Audit and rotate credentials of low-privileged accounts, and review directory logs for anomalous filter patterns originating from the application's bind identity.
   • Monitor for enumeration behavior (high-rate sequential requests to the same action) as a proxy for blind LDAP injection.

2. Patch/upgrade steps

   • No patch exists. Contact Eleveo directly through support or security channels and request a remediation timeline and fixed build. Track the CVE entry for updated references.
   • If Eleveo releases a fixed version, validate in a staging environment and upgrade, verifying that the Username parameter is properly escaped (RFC 4515 LDAP filter escaping) before promoting to production.

3. Long-term hardening

   • Adopt secure coding controls that escape LDAP filter special characters and use parameterized directory query APIs rather than string concatenation.
   • Include LDAP injection in secure code review and SAST coverage for telephony/recording platforms that integrate with directories.
   • Maintain an inventory of internet-exposed call-recording and compliance platforms, since these systems often hold regulated data.
   • Establish a vulnerability disclosure contact and SLA so that future reports do not go unanswered as this one did.

References

• NVD — CVE-2026-101145: https://nvd.nist.gov/vuln/detail/CVE-2026-101145
• CWE-74 — Improper Neutralization of Special Elements (Injection): https://cwe.mitre.org/data/definitions/74.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• OWASP — LDAP Injection: https://owasp.org/www-community/attacks/LDAP_Injection
• RFC 4515 — LDAP: String Representation of Search Filters: https://www.rfc-editor.org/rfc/rfc4515

No CISA KEV listing, threat-actor campaign, or confirmed in-the-wild exploitation evidence is present in the provided intelligence. The NVD description states the exploit is publicly available, but no PoC code, Nuclei template, or exploit reference was supplied.