Description

A flaw was found in 389-ds-base. The Cockpit 389 Console's LDAP editor constructs an ldapsearch command by embedding an LDAP entry's distinguished name (DN) into a shell command string without proper escaping. An LDAP user with delegated privileges to create or rename directory entries could craft a malicious DN containing shell metacharacters. When a Cockpit administrator subsequently views the entry in the 389 Console, the embedded shell command executes with root privileges on the directory server host.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-07T15:17:31.287Z",
  "pubdate": "2026-09-07T15:17:31.287Z",
  "executiveSummary": "A critical command injection vulnerability exists within the Cockpit 389 Console, a management interface for the 389-ds-base directory server. The flaw arises from improper sanitization of LDAP distinguished names (DNs) when constructing shell commands for the ldapsearch utility.\nAn authenticated LDAP user with delegated entry creation or modification privileges can exploit this by crafting a malicious DN containing shell metacharacters. When a privileged Cockpit administrator accesses the compromised entry via the console, the underlying system executes the injected commands with root-level privileges.\nThis vulnerability allows an attacker to achieve arbitrary code execution on the directory server host, bypassing security boundaries and potentially compromising the integrity, confidentiality, and availability of the entire server environment. The impact is severe, as it facilitates full system compromise by leveraging the high-privilege context of the Cockpit interface.\nExploitation requires an attacker to possess the capability to create or rename directory objects within the LDAP tree. It is a secondary-victim attack, where the malicious payload is triggered by the administrative action of viewing the crafted object.",
  "technicalDetails": "The vulnerability resides in the Cockpit 389 Console component of 389-ds-base, specifically within the logic responsible for invoking the ldapsearch command-line utility. The root cause is a failure to implement robust input validation or proper shell-escaping mechanisms for LDAP distinguished names (DNs) before concatenating them into a shell execution string.\nThe attack flow begins when an attacker with low-level delegated privileges, such as the ability to manage specific directory sub-trees, creates or renames an LDAP entry. The attacker crafts the DN to include shell metacharacters, such as backticks (``), semicolon (;), or pipe symbols (|), followed by a desired payload. For example, a DN could be structured as 'cn=dummy,ou=users,dc=example,dc=com; [malicious_command]'.\nWhen a Cockpit administrator navigates to the management interface and attempts to view or audit the object, the console application dynamically constructs a system-level command line to retrieve entry details. Due to the lack of sanitization, the shell interpreter parses the metacharacters within the DN string. Because the Cockpit 389 Console service operates with elevated system privileges—specifically root privileges on the host server—the injected command is executed in that same security context.\nThe payload executes in the background once the administrator triggers the vulnerable function. The exploitation method is highly effective because it relies on legitimate administrative workflows to execute the attack, making it difficult for standard intrusion detection systems to distinguish the malicious command from normal administrative monitoring operations.\nThe post-exploitation impact includes full control over the underlying operating system. An attacker can execute arbitrary binaries, modify system configuration files, install persistence mechanisms, or pivot into other sensitive network segments accessible from the compromised directory server host. Since the process runs as root, there are no internal operating system restrictions preventing the attacker from reading restricted databases, exfiltrating LDAP data, or disabling security auditing logs. The vulnerability essentially elevates a delegated LDAP user to a full administrative host compromise."
}