CVE-2020-26214 LDAP authentication bypass in Alerta
Attackers can bypass LDAP authentication in Alerta by providing an empty password if the LDAP server allows anonymous binds.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-26214?
CVE-2020-26214 is a critical authentication bypass vulnerability in alerta, published on 6 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.
Weakness: CWE-287
Which versions are affected by CVE-2020-26214?
5 open source packages ship an affected version, including alerta-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
alerta-server PyPI | All versions | 7.5.7, 8.1.0 |
alerta-server PyPI | All versions | 7.5.7 |
alerta-server PyPI | All versions | 7.5.7 |
alerta-server PyPI | From 8.0.0 | 8.1.0 |
alerta-server PyPI | From 8.0.0 | 8.1.0 |
Products include Alerta Project Alerta.
How do I fix CVE-2020-26214?
Upgrade alerta-server to a fixed version for your release line: 7.5.7 or 8.1.0.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-26214 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-26214 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in alerta
Sources
Also known as GHSA-5hmm-x8q8-w5jh, PYSEC-2020-159.