CVE-2023-38994

Vulnerability

The check_univention_joinstatus Prometheus monitoring script (and other scripts) in Univention Corporate Server (UCS) 5.0-5 exposes the LDAP plaintext password of the machine account in the process list. When the script runs, the password appears as a command-line argument visible to any local user who can read the process list (e.g., via ps). By default, UCS does not allow local SSH access for regular users, but an attacker who obtains any local shell (e.g., through a compromised service account or physical access) can observe the password. The vulnerability was reported by a security researcher during a penetration test and was fixed by Univention after checking their codebase for similar issues [1].

Exploitation

An attacker requires either local SSH access (which is restricted by default in UCS but may exist in custom configurations) or any means to list running processes on a UCS 5.0-5 system. By running commands such as ps aux or inspecting /proc//cmdline, the attacker can view the plaintext LDAP password passed as an argument to the check_univention_joinstatus script (or other affected scripts). After obtaining the machine account password, the attacker can authenticate as the machine account to the LDAP directory [1].

Impact

Successful exploitation allows an attacker to gain higher privileges within the UCS domain. With the machine account's LDAP credentials, the attacker can query and extract sensitive directory information, including other user credentials and authentication material, potentially leading to complete compromise of the UCS-managed network. The CIA impact is primarily confidentiality (password disclosure) and then privilege escalation (authentication as the machine account), enabling follow-up attacks [1].

Mitigation

Univention fixed this issue by modifying the affected scripts to avoid exposing credentials in the process list and by auditing their codebase for similar problems [1]. The fix was made available promptly after the disclosure timeline. Users should ensure they are running UCS version 5.0-5 or later with all security patches applied. No workaround is detailed for unpatched systems, but administrators can restrict local process inspection (e.g., via kernel configuration or monitoring) and enforce the default SSH access restrictions [1]. Not yet explicitly listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.