GHSA-82vh-6gjg-8qcq: 
Rust vulnerability analysis and mitigation

Severity: Medium – CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (6.8)

• AC:H: the directory must let the attacker create or modify a group entry inside the group search base, and (for the name / distinguishedName variants) the schema must allow those attributes.
• PR:L: the attacker needs a directory account that can sign in to Koreograf.
• Combined with GHSA-hxgj-4rj9-79fq (operator can run code as the server user and read secret.key) the end result is control of the Koreograf host and all stored credentials. That chain is scored in GHSA-hxgj-4rj9-79fq and is not added here. CWE: CWE-863 (Incorrect Authorization), CWE-290 (Authentication Bypass by Spoofing) Package / affected versions: koreograf (rust) <= 0.1.0-alpha.1. Patched in 0.1.0-alpha.2.
• Variant C (CN value parsed as DN) is in 0.1.0-alpha.1.
• Variants A and B (name / distinguishedName attributes) existed only on an unreleased development branch and were never part of a release.

Details

When the user entry has no values in KOREOGRAF_LDAP_GROUP_ATTR (and no memberOf), Koreograf searches the group base for groupOfNames (member), posixGroup (memberUid) and group (member) entries and collects strings that identify each group. sync_ldap_teams then turns every string into match keys and grants operator on every team whose ldap_group equals one of the keys (case-insensitive). The problem is that these strings come from attribute values chosen by whoever controls the group entry, and group_keys treats every string as a DN.

• src/ldap.rs:84-92 group_keys: inserts the raw value as a key and, if cn_from_dn(value) finds a cn= component, also the CN. This runs for plain CN values and name values too, not just for real DNs.
• src/auth.rs:116-131 sync_ldap_teams: keys.contains(team.ldap_group) → upsert_membership(..., Role::Operator, "ldap"). Variant A – name attribute (development branch only, never released). src/ldap.rs:293 requests cn, name, distinguishedName; :311-315 passes name into group_names_from_entry (:242-252). A group cn=spoof-name,ou=groups,... with name: kg-admins yields the key kg-admins and matches a team bound to the CN kg-admins. Variant B – distinguishedName attribute (development branch only, never released). src/ldap.rs:316-317 adds the distinguishedName attribute value unchecked. A group cn=spoof-dn,ou=groups,... with distinguishedName: cn=kg-admins,ou=groups,dc=example,dc=com yields that full DN as a key and, via group_keys, also kg-admins. It matches teams bound to the DN and to the CN. DN binding, which docs/authentication.md:11 presents as the exact form, gives no protection. Variant C – CN value in DN form (0.1.0-alpha.1). search_groups (src/ldap.rs:217-223) pushes the raw cn value. A group whose cn is the literal string cn=kg-admins,ou=groups,dc=example,dc=com (entry DN cn=cn\3Dkg-admins\2Cou\3Dgroups\2C...,ou=groups,...) yields the full DN of the real group as a key plus kg-admins via cn_from_dn. It matches DN-bound and CN-bound teams. No special schema is needed. Note: in 0.1.0-alpha.1 a genuine fallback group never matches a DN-bound team (tracked publicly as a functional bug), but a forged one does. Note (documented behavior, not a separate finding). A team bound to a CN matches every group with that CN anywhere under the search base (cn=kg-admins,ou=projects,ou=groups,... matches a team with ldap_group=kg-admins; docs/authentication.md:11). Today an attacker who can create groups gets CN-bound teams this way already. DN-bound teams are the intended safe option for hardened directories, but they only become safe once A, B and C are fixed. Sign-in logs nothing unusual; the login looks normal.

Proof of concept

Tested 2026-10-20 against OpenLDAP (osixia 1.5.0), with Koreograf 0.1.0-alpha.1 and an unreleased development build.

1. Configure LDAP with KOREOGRAF_LDAP_GROUP_BASE=ou=groups,dc=koreograf,dc=test; the user entry has no memberOf so the fallback runs. Group ACL: authenticated users read ou=groups (0.1.0-alpha.1 searches under the user bind).
2. Create team "Admins DN" with ldap_group=cn=kg-admins,ou=groups,dc=koreograf,dc=test and team "Admins CN" with ldap_group=kg-admins. The user bob is in no group.
3. As a principal allowed to add groups under ou=groups (e.g. a delegated group owner), add one of:

   # Variant A (development build only)
   dn: cn=spoof-name,ou=groups,dc=koreograf,dc=test
   objectClass: groupOfNames
   objectClass: extensibleObject
   cn: spoof-name
   name: kg-admins
   member: uid=bob,ou=people,dc=koreograf,dc=test
   # Variant B (development build only)
   dn: cn=spoof-dn,ou=groups,dc=koreograf,dc=test
   objectClass: groupOfNames
   objectClass: extensibleObject
   cn: spoof-dn
   distinguishedName: cn=kg-admins,ou=groups,dc=koreograf,dc=test
   member: uid=bob,ou=people,dc=koreograf,dc=test
   # Variant C (0.1.0-alpha.1)
   dn: cn=cn\3Dkg-admins\2Cou\3Dgroups\2Cdc\3Dkoreograf\2Cdc\3Dtest,ou=groups,dc=koreograf,dc=test
   objectClass: groupOfNames
   cn: cn=kg-admins,ou=groups,dc=koreograf,dc=test
   member: uid=bob,ou=people,dc=koreograf,dc=test

4. Sign in as bob (POST /api/session) and list memberships. | Case | Unreleased development build | 0.1.0-alpha.1 | | --- | --- | --- | | Control: harmless group | no teams | no teams | | A name: kg-admins | Admins CN | no teams | | B distinguishedName: <DN of kg-admins> | Admins CN + Admins DN | no teams | | C cn: <DN of kg-admins> | Admins CN + Admins DN | Admins CN + Admins DN | | Note: same CN in another OU | Admins CN | Admins CN | Membership is operator, source ldap.

Preconditions

• LDAP mode with the group-search fallback in use (user entries without memberOf / KOREOGRAF_LDAP_GROUP_ATTR values, e.g. OpenLDAP without the memberOf overlay, or posixGroup setups).
• The attacker has a directory account that can sign in and can create a group, or edit a group they are a member of, inside the group search base (KOREOGRAF_LDAP_GROUP_BASE, or KOREOGRAF_LDAP_USER_BASE when it is empty). Typical cases: delegated group management (by dnattr=owner write), self-service OUs.
• Variants A and B additionally need a schema that allows name / distinguishedName on the group (extensibleObject or a custom schema). Variant C needs no special schema.
• Active Directory is not exploitable this way: name and distinguishedName are system-maintained attributes there and cannot be set by users, and AD users normally have memberOf, so the fallback does not run.

Impact

The attacker becomes operator in every LDAP-mapped team they choose, including administrative ones, and can launch that team's templates and workflows against its inventories using its credentials. With GHSA-hxgj-4rj9-79fq (operator → code execution as the server user, read secret.key) this extends to full control of the Koreograf host and decryption of every team's stored credentials.

Remediation

1. Identify a found group only by the entry DN returned by the server (parsed.dn). Do not read the distinguishedName attribute value; in AD it equals the entry DN anyway.
2. Drop name, or use it only when it equals the RDN value of the entry DN.
3. Apply DN parsing and CN extraction in group_keys only to values that are real DNs: memberOf values from the server and entry DNs. Never parse a CN or name value as a DN. Keep separate key sets (DN keys vs. CN keys) so a DN-bound team only matches a server-provided DN.
4. Compare DNs in normalized form (RFC 4514, including hex escapes such as \3D; unescape_dn currently only strips the backslash).
5. Docs: recommend DN-bound teams for directories where users can create groups, and state that a CN binding matches that CN in any OU under the search base.
6. Regression test against OpenLDAP: control group, variants A/B/C and the same-CN-other-OU case; assert that A/B/C grant no team.

Credits

Found by internal testing, 2026-10-20.

Patches

Fixed in v0.1.0-alpha.2. Group DNs are parsed into RDNs, each value is decoded and escaped again per RFC 4514 before comparison, the CN is taken only from a first RDN that is a single cn, and CN and DN keys are kept apart. 0.1.0-alpha.3 keeps the same code.

Workarounds

Bind teams only to groups whose entries ordinary users cannot create or modify, or set KOREOGRAF_LDAP_GROUP_ATTR/memberOf so the group search fallback does not run.