CVE-2025-62795: Unauthorized LDAP Config Access via WebSocket

Key Information Vulnerability Overview Vulnerability Name: Unauthorized LDAP Configuration Access via WebSocket CVE ID: CVE-2025-62795 Severity: High (7.1 / 10) Affected Scope Affected Versions: =v3.10.21, >=v4.10.12 Description Impact: Low-privileged authenticated users can send specially crafted messages via the WebSocket endpoint to trigger LDAP configuration testing and initiate LDAP synchronization, bypassing authorization checks. This may lead to exposure of LDAP credentials or unintended synchronization operations. Details Issue: The WebSocket endpoint exposes server-side LDAP testing and synchronization functionalities without proper authorization. Attacker Can: - Cause the server to connect to an LDAP host controlled by the attacker, potentially exposing stored LDAP bind credentials. - Trigger unintended LDAP synchronization or user import operations. Reproduction Steps 1. Ensure the server’s LDAP settings are properly configured. 2. Authenticate as a regular/low-privileged user. 3. Establish a WebSocket connection to the server’s endpoint using the same headers (e.g., session cookie/authentication token) as a legitimate client. 4. Send a JSON message requesting LDAP configuration testing or synchronization. Example payload: 5. Observe the server performing the test connection (e.g., outbound connection to EVIL_IP, logs indicating binding attempts, or server returning test results). If the server uses stored integration credentials during testing, these credentials may be transmitted or validated on the attacker-controlled server, leading to credential leakage. Mitigation Secure Versions: v3.10.21 and above, v4.10.12 and above Acknowledgments Thanks to @GoodEekh (Sergey Gerasimov of SolidLab LLC) for reporting this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-62795: Unauthorized LDAP Config Access via WebSocket

More from this source