CVE-2024-9101

What it actually does

Reflected XSS in phpLDAPadmin Entry Chooser passes the 'element' parameter unsafely to JavaScript eval, enabling arbitrary script execution in the victim's browser when the 'opener' condition is met.

Why it matters to the business

Attackers may hijack admin sessions or steal data from LDAP directory management interfaces, leading to unauthorized access and potential compliance issues in environments using this tool.

How an attack unfolds

An attacker crafts a malicious URL targeting the Entry Chooser with a crafted 'element' value containing JavaScript. When a user with a properly set 'opener' accesses the link, the payload executes via eval in the browser context.

How to fix it

Upgrade leenooks/phpldapadmin to commit f713afc8d164169516c91b0988531f2accb9bce6 or later; apply vendor patches promptly given the low but present EPSS score and lack of KEV listing.

How to confirm the fix worked

Verify deployed version against the fixed commit, review source for removal of unsafe eval on the element parameter, and test the Entry Chooser endpoint with benign payloads to confirm script execution is blocked.

Typical attack path

1. Identify phpLDAPadmin instance running version 1.2.1 to 1.2.6.7
2. Craft URL with malicious payload in the 'element' parameter
3. Ensure or induce condition where 'opener' is set
4. Deliver link to authenticated admin user via phishing or other means
5. Execute arbitrary JavaScript in browser upon link activation

How to detect it

Inspect web server logs for requests to the Entry Chooser endpoint containing suspicious 'element' parameter values that include script or eval constructs; correlate with user activity showing unexpected browser behavior.

• element=.*eval(
• opener.*element=.*script

What your security team should do

• Apply the fixed commit immediately to all phpLDAPadmin instances
• Monitor for any reflected XSS attempts targeting the Entry Chooser
• Restrict access to phpLDAPadmin to trusted networks only
• Educate admins on verifying link sources before interaction