CVE-2024-23333

What it actually does

The vulnerability permits an authenticated administrator to configure arbitrary file paths for application logs; by directing logs to a web-accessible PHP file and causing the application to write executable PHP code into that file, an attacker can achieve remote code execution when the file is subsequently requested over HTTP.

Why it matters to the business

Successful exploitation can result in full compromise of the LDAP management server, enabling attackers to execute arbitrary commands, exfiltrate or alter directory data, and potentially pivot to other systems, leading to operational disruption and data breaches.

How an attack unfolds

An attacker first obtains the LAM master configuration password, then modifies the log settings to specify a web-reachable directory path ending in .php, triggers logging activity that writes a PHP payload into the file, and finally browses to the created file via the web server to execute the injected code.

How to fix it

Upgrade to LAM version 8.7 or later. As a temporary mitigation, restrict access to all LAM configuration pages to only authorized administrators and ensure the web server process lacks write permissions to any web-accessible directories.

How to confirm the fix worked

Confirm the installed LAM version is 8.7 or newer; audit current log file paths in the configuration to verify none resolve to web-accessible locations; test that configuration pages remain inaccessible to unprivileged users.

Typical attack path

1. Acquire LAM master configuration password
2. Alter log configuration to target a web-accessible .php file
3. Generate log events that embed PHP code into the target file
4. Request the malicious PHP file through the web server to trigger execution

How to detect it

Inspect application and web server logs for modifications to log file paths, especially entries pointing outside expected directories; search for newly created .php files in web roots with timestamps correlating to configuration changes; review access logs for unexpected requests to previously nonexistent PHP files.

What your security team should do

• Immediately upgrade all LAM instances to version 8.7
• Enforce least-privilege access controls on configuration interfaces
• Review web server file permissions to prevent write access to served directories
• Monitor authentication logs for unusual master-password usage