GHSA-xghw-p77p-3r7x
Fabric CA Developer's Guide: LDAP Injection via Unescaped Username in GetUser Filter
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/hyperledger/fabric-ca | < 1.5.21 | 1.5.21 |
Details
As written in the advisory (Markdown source, shown as plain text).
When fabric-ca is configured with an LDAP backend, the username from HTTP Basic authentication is included in an LDAP uid search filter without proper escaping. An unauthenticated attacker with network access to the CA enrollment endpoint could exploit this to perform LDAP injection before password validation, and potentially steer authentication attempts toward a victim account.
### Recommendation
- All users of fabric-ca with an LDAP backend should update to a fixed version.
- For users not using an LDAP backend, no action is required.
References
External links from the advisory. They lead to third-party sites.