An unauthenticated arbitrary object instantiation vulnerability in LDAP Account Manager (LAM) has been discovered during an internal penetration test.
LAM is a PHP web application for managing entries such as users, groups, or DHCP settings in LDAP directories via a web frontend, and is one of the alternatives to FreeIPA. It’s included in Debian repositories.
But a vulnerability discovered by researcher Arseniy Sharoglazov could allow an attacker to create arbitrary objects and achieve remote code execution (RCE) in one request, and without any out-of-band connections.
The technique depends on exploiting the construction new $a($b), with the variable $a standing for the class name that the object will be created for, and the variable $b denoting the first argument to be passed to the object’s constructor.
“When you code in any programming language, you can use good or bad programming practices. The usage of the construction new $a($b), which instantiates arbitrary objects, is a bad practice, if $a and $b come from a non-controlled input,” Sharoglazov tells The daily swig.
“It’s a dodgy construction. However, no one showed that it’s really dangerous, so some people think that everything should be alright.”
While the technique requires the Imagick extension, he says, this is usually present in larger websites, including the LAM system itself.
Sharoglazov says that similar arbitrary object instantiation vulnerabilities have been around for quite some time, but aren’t usually reported as such.
“For example, you might read about an SSRF in a commercial software. If you knew the PoC, you would see that it’s actually an arbitrary object instantiation with the usage of the SoapClient class, for instance. But for the public it will be just SSRF,” he says.
“Or you might read about an SQL injection. But it’s actually an arbitrary object instantiation exploited via a user-defined class which has an SQL injection. This technique, which I found and described, shows how to exploit an arbitrary object instantiation directly to RCE.”
Sharoglazov says the disclosure process went quickly and efficiently. He first reported the flaw on 16 June, with LAM 8.0.1 released on June 29, Debian packages updated on July 5, and public disclosure on July 14.
“I wrote to Roland Gruber, the developer of LAM, and I got an initial reply in just one hour,” he says.
“We discussed what needs to be done to fix the vulnerabilities, and the hardening process that will make LAM way more secure. Afterwards, we did a coordinated disclosure with him and Debian.”
Erik Ten Hag Chops First Breakfast as Man Utd Manager as Brighton Wins 2-1
Man Utd must let Ronaldo leave – Wayne Rooney
Australia Scholarship: Apply for Griffith University degree scholarship, 2022
Edo Govt To Recruit 1000 New Teachers, Train 650 Others
Ebonyi Govt Laments Destruction Of Airport Fence
Transfer: Real Madrid star, Isco to Sevilla as free agent
Transfer: Neto joins Bournemouth from Barcelona
Kano loses one pilgrim in Saudi Arabia
Tobi Amusan wins a gold medal at the Commonwealth Games and breaks a record
Deposed Emir Sanusi: “I’ll keep speaking out to rebuild Nigeria.”
Religious organizations disagree on how to pay for the Jos Main Market project
Jenkins security: The most recent plugin advisory contains flaws with unpatched XSS and CSRF
ParseThru: Multiple Go apps have been found to have an HTTP parameter smuggling issue
Director of Batgirl reveals After the movie was canceled, Marvel CEO Kevin Feige contacted him
Our pop queen dreams have come true with the epic Break My Soul and Vogue remix by Beyonce and Madonna
Buhari condemns killings of Nigeriens and police officials in South East
In Ekiti, gunmen abduct a 4-year-old boy while the father runs
NDA changes the curriculum to better train cadets for asymmetrical warfare
In Everton’s tight loss to Chelsea, Alex Iwobi shines for the team
Following a 4-1 loss to Tottenham, Aribo’s manager lashes out “not good enough.”
Mohammed Usman, Kamaru Usman’s younger brother crowned UFC TUF Champion [Images/Video]
BBNaija S7: Beauty says, “He’s fingered me and sucked my breast,” as she drags Groovy
BBNaija S7: Denrele claims that bbnaija candidates send him n*des and millions of naira in order to take part in the show
I’m not at Man City to win UEFA Champions League – Pep Guardiola
Buhari Has Delivered, Security Only Exists In Heaven – Festus Keyamo
2023: Ogun State Is Nobody’s Inheritance – Dapo Abiodun
Your weekly tarot horoscope for August 7 to August 13 and Venus’s move into Leo
“Until A Man Is Financially Stable, He’s Not Truly Happy” – Toolz
Hard Decisions Needed To End ASUU Strike – JAMB boss
Bola Tinubu Sees Presidency As Retirement Benefits – Dino Melaye
Your daily horoscope for Sunday, August 7, 2022
Vinicius Jr Wants Five or More UCL at Real Madrid
Why Juventus, Atletico Madrid Game Got Cancelled
Peruzzi Bags 7-days Ultimatum To Refund ₦3 Million Over Breach of Contract
EPL: Thomas Tuchel revels Marcos Alonso’s decision
Messi Scores Brace as PSG Effortlessly Thrashed Clermont Foot
Buhari Vows To Track Down Killers Of Imo Police Officers
[STORY] SADE’S HEART TALE (Episode 20)
5 Reasons To Start Playing Computer Games
XSS in Gmail’s AMP For Email earns researcher $5,000
[STORY] MONEY OVER LOVE (Complete Episodes)
[STORY] THE WITCH’S DAUGHTER (Complete Episodes)
[STORY] SADE’S HEART TALE (Episode 19)
[STORY] MONEY OVER LOVE (Episode 01)
[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Complete Episodes)
[STORY] THE WITCH’S DAUGHTER (Episode 07)
[STORY] THE WITCH’S DAUGHTER (Episode 03)
[STORY] THE WITCH’S DAUGHTER (Episode 05)
[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Episode 01)
[STORY] THE WITCH’S DAUGHTER (Episode 01)
Nwankwo Kanu, a Super Eagles icon, turns 46 [Photos]
[STORY] MONEY OVER LOVE (Episode 09)
[STORY] THE WITCH’S DAUGHTER (Episode 04)
[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Episode 02)
Watch the latest “Passport” movie teaser with Mercy Johnson, Zubby Michael, and Jim Iyke
[STORY] THE WITCH’S DAUGHTER (Episode 06)
[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Episode 03)
[STORY] WHAT MY ELDER BROTHER’S WIFE TAUGHT ME (Final Episode 04)
[STORY] THE WITCH’S DAUGHTER (Episode 02)
[STORY] MONEY OVER LOVE (Episode 05)
A sizable piece of Elon Musk’s space junk has fallen onto an Australian man’s farm.
[STORY] MONEY OVER LOVE (Episode 04)
How To Receive Google AdSense Payment To GTB, UBA, Access, FCMB, First Bank – SWIFT – BIC CODE
[STORY] MONEY OVER LOVE (Episode 03)
Hilda Dokubo comments on the ransom demanded for colleagues who have been kidnapped: “Some actors present the incorrect picture on social media.”
[STORY] MONEY OVER LOVE (Episode 12)
[STORY] THE WITCH’S DAUGHTER (Final Episode 09)
Monalisa Chida claims the abductor’s phone may be used to find kidnapped Nollywood actors.
Kcee Marzz incorporates highlife in his latest song, “In the air,”
The representatives of Victor Osimhen call a CRUNCH meeting to debate the future of Napoli.
[STORY] MONEY OVER LOVE (Episode 06)
[STORY] MONEY OVER LOVE (Episode 08)
Epic movie “Anikulapo” by Kunle Afolayan is scheduled to premiere in September
“Nancy Isime Did Butt Enlargement Surgery” – Blessing Okoro Makes Shocking Revelation
[STORY] MONEY OVER LOVE (Episode 02)
[STORY] MONEY OVER LOVE (Episode 17)
Danielle’s graduation is a cause for celebration for Jay-Jay Okocha.
[STORY] MONEY OVER LOVE (Episode 10)
Nkem Owoh Breaks Silence On Claims He Rejected N10 Million To Endorse Bola Tinubu For President
Revealed: Why Watford goalkeeper Maduka Okoye was not included in the team on Monday
ANE's Billboard Hots
Technology1 month ago
VoIP Number: Everything You Need To Know
Music6 years ago
[Music] Ed Sheeran – Perfect
Music5 years ago
[Music] Wiz Khalifa – See You Again ft. Charlie Puth
Music1 month ago
[Instrumental] Wiz Khalifa – See You Again ft. Charlie Puth
ANE Stories1 month ago
The Story Of My Life (Complete Episode 1 – 47)
Movie Subtitle1 month ago
DOWNLOAD Complete Money Heist Season 1 Subtitles File [English SRT] 2017
Music3 years ago
[Music] Gnash Ft Olivia O’Brien – I Hate you, I Love you
Music1 month ago
[Video] 21 Savage ft. Offset & Metro Boomin – Rap Saved Me