LDAP Authentication Bypass

Information

  • Advisory ID: DSA-2023-010

  • CVE reference: CVE-2023-51717

  • CVSS Base Score: 9.8

  • CVSS String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Severity: Critical

  • CWE classification: CWE-287

  • Advisory Release Date: Dec 21st, 2023 19:00 CET

Summary

Before Dataiku DSS 11.4.5 and 12.4.1, verification of credentials when authenticating with LDAP identity was insufficient.

Depending on the configuration of the LDAP server, this could lead to a full authentication bypass.

Affected Products

Dataiku DSS before 11.4.5 and 12.4.1

Affected Situations

Dataiku Cloud customers are not affected.

Only customers who have enabled LDAP support in Dataiku DSS are affected.

Furthermore, to be affected, your LDAP server needs to be configured to allow “unauthenticated binds” (not to be confused with “anonymous binds”). This is a discouraged behavior as per LDAP specification, but is the default behavior of Microsoft Active Directory.

Mitigation

Customers running Dataiku DSS 12.1.0 or above, and who are using SSO in addition to LDAP (i.e., users are not authenticating to Dataiku DSS through their LDAP password, but through SSO, and LDAP is only used for provisioning), can mitigate the issue by disabling “Allow user authentication” in the LDAP settings (Admin > Settings > User login & provisioning)

Remediation

Dataiku DSS 12.4.1 has been made available to customers to remediate this issue.

In addition, for customers still running Dataiku DSS 11, Dataiku DSS 11.4.5 has been made available to remediate the issue.

Acknowledgement

Dataiku would like to thank Christian Turri, consultant, for discovering and reporting the issue.

Contact

E-mail: security@dataiku.com

Last modified

Dec 22nd, 2023

Timeline

  • Dec 20th, 2023: Issue reported to vendor

  • Dec 20th, 2023: Issue confirmed and acknowledged by vendor

  • Dec 21st, 2023: Fixed versions published and advisory published

  • Dec 22nd, 2023: CVE id assigned and added to the advisory