CVE-2020-35775

Vulnerability

CITSmart ITSM versions prior to 9.1.2.23 contain an LDAP injection vulnerability in the LDAP integration module. The flaw resides in the LDAPUtils.java file [1], where user-supplied input is concatenated directly into LDAP query strings without proper sanitization or parameterization. This allows an attacker to inject arbitrary LDAP filter syntax.

Exploitation

An attacker can exploit this vulnerability by sending specially crafted input to any CITSmart endpoint that uses LDAP queries, such as authentication or user lookup functions. No prior authentication is required if the vulnerable endpoint is exposed. The attacker injects LDAP metacharacters (e.g., *, |, &, !) to alter the query logic, potentially bypassing authentication or extracting directory information [2].

Impact

Successful exploitation enables an attacker to bypass authentication, enumerate LDAP directory entries, or gain unauthorized access to the CITSmart system. This can lead to disclosure of sensitive user information and privilege escalation, compromising the confidentiality and integrity of the affected instance.

Mitigation

Upgrade to CITSmart version 9.1.2.23 or later, which includes the fix for this vulnerability [2]. No official workaround has been published. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.