Hi,
I discovered a bug when we use LDAP authentication.
I put LDAP username in login input, then i submit login with empty password, we obtain a successfull authentication.
TO fix the problem i modified the /tool/loginCheck.php file on line 21 : replace if ($password=="") {...} by if (AesCtr::decrypt($password, $_SESSION['sessionSalt']=="") . Password is encrypt, so $password is never empty, then when the function ldap_bind (/model/User.php line 798) is used, it always return true because of empty password.
Thank you.
Hi,
Thank you for this acurate analysis.
What seems strange to me is that code on line 805 in User.php should refuse empty password.
if (! $bind_user or !$parampassword) {
//debugLog("incorrect binding");
return "login";
}
Moreover, try and disable anonymous connection to your LDAP : empty password should fail.
Anyway, your proposale is cute and will secure this phase.
I will include it in next patch version (V4.3.3)
Thanks.
Indeed, this verification seems not to be in 4.1.2 version (we are again on this version), so this bug is probably not on lastests versions. I apologize !
Maybe it will not be fixed yet next time. 🙂
Thanks for your reply.
I am on 4.3.2 with ldap auth. It refuses blank password.