George0Papasotiriou/CVE-2026-5050-Blind-LDAP-Injection-via-Unescaped-Filter
GitHub: George0Papasotiriou/CVE-2026-5050-Blind-LDAP-Injection-via-Unescaped-Filter
该项目模拟了一个存在 LDAP 注入漏洞的认证服务器，并附带漏洞利用脚本，用于复现和演示 CVE-2026-5050。
Stars: 0 | Forks: 0
## CVE-2026-5050 – 通过未转义 Filter 导致的 Blind LDAP Injection
### **程序代码 (Python 与 ldap3 模拟)**
```
# ldap_server_sim.py - 模拟 LDAP 认证服务器
from flask import Flask, request, jsonify
app = Flask(__name__)
# 模拟用户数据库
USERS = {
'admin': {'password': 'secret', 'role': 'admin'},
'user': {'password': 'pass', 'role': 'user'}
}
def ldap_search(username, password):
# Simulate an LDAP filter injection: user-controlled username goes directly into filter
# Real LDAP query: (&(uid={username})(userPassword={password}))
# Here we just simulate: if the username contains wildcard, it may bypass.
if '*' in username:
# Vulnerability: filter becomes (uid=*) which matches any user
# We'll return the first matching user (admin)
return USERS.get('admin')
return USERS.get(username)
@app.route('/login', methods=['POST'])
def login():
username = request.form.get('username')
password = request.form.get('password')
user = ldap_search(username, password)
if user and user['password'] == password:
return jsonify({"message": "Authenticated", "role": user['role']})
return jsonify({"message": "Invalid"}), 401
if __name__ == '__main__':
app.run(port=5000)
```
# CVE-2026-5050 – 通过未转义 Filter 导致的 Blind LDAP Injection
## 概述
身份验证系统通过直接拼接用户输入来构建 LDAP 搜索 filter，且未对特殊字符进行转义。攻击者可以注入通配符 (`*`) 来绕过身份验证或枚举用户。
## 漏洞详情
- **类型：** LDAP Injection
- **影响：** 绕过身份验证、信息泄露。
- **根本原因：** username 参数未经处理，导致 `*`、`(`、`)` 等字符可以修改 LDAP filter 逻辑。
## 漏洞利用演示
1. 启动模拟的漏洞服务器：
pip install flask
python ldap_server_sim.py
2. 运行 exploit：
python exploit_ldap_injection.py
标签：CISA项目, Flask, LDAP注入, Python, 无后门, 漏洞环境, 身份验证绕过, 逆向工具