CVE-2017-11107

What it actually does

The vulnerability permits reflected cross-site scripting by failing to sanitize user-controlled values in the form, element, rdn, or container parameters passed to entry_chooser.php, allowing arbitrary JavaScript to execute in the context of a victim's browser session.

Why it matters to the business

Successful exploitation can lead to theft of administrative credentials, unauthorized directory modifications, or use of the interface as a pivot for further attacks; public weaponized exploits increase the likelihood of opportunistic abuse even years after disclosure.

How an attack unfolds

An attacker crafts a malicious link or form submission that embeds JavaScript payloads in one of the vulnerable parameters, then tricks an authenticated phpLDAPadmin user into clicking it; once executed, the script performs actions on behalf of the victim or exfiltrates session data. Publicly available weaponized exploits lower the barrier for automated or script-kiddie attacks.

How to fix it

Upgrade phpLDAPadmin to a version that sanitizes or removes the vulnerable parameters; for the listed nri-nagios packages the issue is resolved at version 0. Apply web-application firewall rules that block common XSS patterns in query strings as a temporary control.

How to confirm the fix worked

Confirm the fix by reviewing the entry_chooser.php source for proper output encoding or parameter filtering, re-test the four parameters with benign payloads to ensure no script execution occurs, and verify deployed package versions match the stated fixed releases.

Typical attack path

1. Identify a reachable phpLDAPadmin instance and the entry_chooser.php endpoint
2. Craft a URL containing a script payload in the form, element, rdn, or container parameter
3. Deliver the link via phishing or a compromised page to an authenticated administrator
4. Victim's browser executes the injected script, enabling session hijacking or malicious directory operations

How to detect it

Review web-server access logs for requests to entry_chooser.php that contain HTML tags, JavaScript keywords, or unusually long parameter values; correlate with successful responses (200) followed by administrative actions performed by the same session.

• entry_chooser.php?form=
• entry_chooser.php?element=
• entry_chooser.php?rdn=
• entry_chooser.php?container=

What your security team should do

• Prioritize removal or upgrade of any phpLDAPadmin deployments still running versions through 1.2.3
• Scan web logs for the last 90 days for suspicious entry_chooser.php requests containing script tags or event handlers
• Implement Content-Security-Policy headers on the administrative interface to reduce XSS impact
• Disable or restrict access to phpLDAPadmin from untrusted networks until remediation is complete