CVE-2024-23333 LAM vulnerable to Authenticated Remote Code Execution
Authenticated attackers with master password access can inject PHP code into log files for remote code execution if web server write permissions are misconfigured.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-23333?
CVE-2024-23333 is a high-severity code injection vulnerability in LDAPAccountManager lam, published on 18 Mar 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM's log configuration allows to specify arbitrary paths for log files. Prior to version 8.7, an attacker could exploit this by creating a PHP file and cause LAM to log some PHP code to this file. When the file is then accessed via web the code would be executed. The issue is mitigated by the following: An attacker needs to know LAM's master configuration password to be able to change the main settings; and the webserver needs write access to a directory that is accessible via web. LAM itself does not provide any such directories. The issue has been fixed in 8.7. As a workaround, limit access to LAM configuration pages to authorized users.
Weakness: CWE-74
Which versions are affected by CVE-2024-23333?
It affects 1 product.
Products include Ldap-Account-Manager Ldap Account Manager.
How do I fix CVE-2024-23333?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-23333 being exploited?
There is no known exploitation of CVE-2024-23333 in the wild and no public exploit code.
Other vulnerabilities in LDAPAccountManager lam
Sources
Also known as DEBIAN-CVE-2024-23333, GHSA-fm9w-7m7v-wxqv, UBUNTU-CVE-2024-23333.