CVE-2023-4727

What it actually does

The token authentication scheme is bypassed via LDAP injection when the sessionID=* query parameter is supplied, allowing an attacker to authenticate using any existing session stored in the LDAP directory and escalate privileges.

Why it matters to the business

Attackers could obtain unauthorized access to certificate and PKI management systems, risking compromise of cryptographic infrastructure and sensitive operations with minimal attacker effort.

How an attack unfolds

An attacker supplies the sessionID=* parameter in an authentication request; the unsanitized value is interpreted as an LDAP wildcard, matching any stored session record and granting the privileges of that session without valid credentials.

How to fix it

Apply the latest vendor patches for dogtag-pki and pki-core that enforce proper input sanitization on session identifiers and validate tokens server-side before LDAP lookup.

How to confirm the fix worked

Confirm that sessionID values are escaped or rejected when containing wildcards, re-test authentication flows with both valid and malicious parameters, and verify no unauthenticated escalation paths remain.

Typical attack path

1. Locate a dogtag-pki or pki-core authentication endpoint accepting sessionID
2. Submit crafted request containing sessionID=*
3. Obtain authenticated session from LDAP match
4. Perform privileged operations under the hijacked identity

How to detect it

Inspect web server and application logs for requests containing sessionID=*, review LDAP query logs for wildcard session lookups, and correlate with privilege changes or new administrative actions.

• sessionID=*
• sessionID=%2A
• LDAP search filter containing (sessionID=*)

What your security team should do

• Prioritize patching all dogtag-pki and pki-core deployments
• Monitor authentication logs for sessionID=* or wildcard patterns
• Review LDAP schema and access controls protecting stored sessions