CVE-2021-29156 PoC — Forgerock ForgeRock OpenAM 注入漏洞

Source

https://github.com/5amu/CVE-2021-29156

Associated Vulnerability

Title: Forgerock ForgeRock OpenAM 注入漏洞 (CVE-2021-29156)
Description:ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.

Description

Exploit for CVE-2021-29156

Readme

# CVE-2021-29156 done right

This Proof of Concept is realized because the other PoC publicly available is broken ✨

## Install

```
go install github.com/5amu/CVE-2021-29156@latest
```

## References

* [https://nvd.nist.gov/vuln/detail/CVE-2021-29156](https://nvd.nist.gov/vuln/detail/CVE-2021-29156)
* [https://portswigger.net/research/hidden-oauth-attack-vectors](https://portswigger.net/research/hidden-oauth-attack-vectors)
* [https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0](https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →