CyberRota Analysis
AI-GeneratedFabric CA, utilized as a Certificate Authority for Hyperledger Fabric, is vulnerable when configured with an LDAP backend, allowing unauthenticated attackers to manipulate LDAP queries through HTTP Basic authentication. This could lead to unauthorized access by steering authentication attempts towards a victim account. Organizations using Fabric CA with LDAP should prioritize upgrading to version 1.5.21 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Fabric CA is a Certificate Authority for Hyperledger Fabric. Prior to 1.5.21, when fabric-ca is configured with an LDAP backend, Client.GetUser in lib/server/ldap/client.go inserts the username from HTTP Basic authentication into the LDAP uid search UserFilter without escaping LDAP metacharacters. An unauthenticated attacker with network access to the CA enrollment endpoint can alter the LDAP search before password validation and potentially steer authentication attempts toward a victim account. Deployments that do not use an LDAP backend are unaffected. This issue is fixed in version 1.5.21.