CVE-2024-52792

What it actually does

Improper sanitization of configuration inputs in mainmanage.php and confmain.php allows newline smuggling to inject arbitrary key-value pairs into config.cfg or serverprofile.conf, bypassing the mitigation for CVE-2024-23333.

Why it matters to the business

Attackers with configuration privileges can alter LDAP directory management settings, potentially disabling security controls and leading to unauthorized changes in user, group, or DHCP entries across the directory.

How an attack unfolds

An authenticated administrator accesses the configuration pages, inserts a newline followed by a malicious setting into a field processed by mainmanage.php or confmain.php, writes the injected value into the persistent config file, and then leverages the altered configuration to bypass prior mitigations.

How to fix it

Upgrade ldapaccountmanager/lam to the commit 1fbcbea3c17e77d65d8ea0ff73c1e663387d25b5 or later release 9.0; no workarounds exist.

How to confirm the fix worked

Verify the installed version includes commit 1fbcbea3c17e77d65d8ea0ff73c1e663387d25b5; attempt newline injection in configuration fields and confirm values are rejected or sanitized before writing to disk.

Typical attack path

1. Obtain administrative access to LAM configuration interfaces
2. Identify input fields written to config.cfg or serverprofile.conf
3. Craft payload containing newline plus arbitrary config directive
4. Submit via mainmanage.php or confmain.php to persist the value
5. Confirm bypass of CVE-2024-23333 mitigation through modified behavior

How to detect it

Review web server access logs for requests to mainmanage.php and confmain.php containing encoded newlines or unusual parameter lengths; inspect config.cfg and serverprofile.conf for lines added outside normal administrative workflows; correlate with LDAP directory changes after configuration updates.

• %0A
• \n
• config.cfg
• serverprofile.conf

What your security team should do

• Upgrade to the fixed commit or version 9.0 immediately
• Audit all existing config.cfg and serverprofile.conf files for unexpected entries
• Restrict administrative access to configuration pages until patched
• Monitor for post-patch config changes via file integrity monitoring