CVE-2024-45160

What it actually does

The vulnerability stems from missing validation of the client_password parameter during OAuth2 client authentication, allowing an empty value to satisfy the secret check and grant authenticated client status.

Why it matters to the business

Attackers can obtain unauthorized access to protected resources and user data by impersonating legitimate OAuth2 clients, increasing risk of data exposure and compliance violations in organizations relying on LemonLDAP::NG for identity federation.

How an attack unfolds

An attacker crafts an OAuth2 token request to a LemonLDAP::NG instance and supplies an empty client_password value; because the server performs no length or presence check on the secret, the request is accepted as coming from a valid client, resulting in issuance of access tokens without proper credentials.

How to fix it

Upgrade LemonLDAP::NG to version 2.19.2 or later; the fix is present in commit 06d771cbc2d5c752354c50f83e4912e5879f9aa2. If immediate upgrade is not possible, enforce strict client secret validation via custom configuration or disable OAuth2 clients that rely on the affected code path.

How to confirm the fix worked

Confirm the installed version is at least 2.19.2, then attempt an OAuth2 token request with an empty client_password and verify that the request is rejected with an invalid_client error.

Typical attack path

1. Identify a LemonLDAP::NG deployment exposing OAuth2 endpoints
2. Send an authorization or token request with a valid client_id but empty client_password parameter
3. Receive a successful token response bypassing secret validation
4. Use the obtained token to access downstream protected APIs or resources

How to detect it

Search authentication and access logs for OAuth2 token requests that contain a client_id paired with an absent or empty client_password or client_secret field; correlate with successful token issuance events.

• client_password=
• client_secret= (empty value) followed by HTTP 200 on /oauth2/token
• oauth2.*invalid_client absent in logs for requests with missing secret

What your security team should do

• Prioritize upgrade of all LemonLDAP::NG instances to the fixed version within the next maintenance window
• Audit OAuth2 client configurations for use of empty or weak secrets
• Enable detailed logging of authentication failures for OAuth2 endpoints
• Review downstream applications for reliance on the affected OAuth2 clients