Description

A flaw was found in 389 Directory Server. The SELFDN ACI bind-rule evaluator incorrectly matches an anonymous LDAP client's empty bind DN against an empty stored attribute value, allowing an unauthenticated client to satisfy access control checks intended to require a matching authenticated identity. This can allow an anonymous LDAP client to perform an operation, such as adding or modifying a directory entry, that a SELFDN-based ACI intended to restrict to a specific authenticated user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-07T14:16:54.197Z",
  "pubdate": "2026-09-07T14:16:54.197Z",
  "executiveSummary": "A critical access control vulnerability exists in the 389 Directory Server related to the SELFDN ACI bind-rule evaluator.\nThe flaw stems from an improper validation of LDAP bind DNs, where an anonymous client with an empty bind DN is incorrectly matched against empty stored attribute values.\nThis vulnerability allows an unauthenticated, anonymous attacker to bypass intended access control constraints.\nBy successfully triggering this logic error, an attacker can satisfy SELFDN-based ACI checks that were designed to restrict operations to a specifically authenticated user.\nThe impact is significant, as it permits unauthorized users to perform sensitive directory operations—such as adding or modifying directory entries—that should be restricted to privileged or self-authenticated identities.\nThis is an authentication bypass scenario that does not require prior credentials, making it a high-risk security defect for directory services that rely on SELFDN for granular authorization enforcement.\nOrganizations utilizing 389 Directory Server with SELFDN-based access controls are exposed to unauthorized data modification and potential directory integrity compromise.",
  "technicalDetails": "The vulnerability resides within the SELFDN ACI (Access Control Instruction) bind-rule evaluator component of the 389 Directory Server. SELFDN is a mechanism used to allow users to perform actions on their own entries by comparing their authenticated DN against specific attributes within the target entry.\nThe root cause is a logic error in how the evaluator handles the comparison between an anonymous client’s empty bind DN and empty or null attributes within the target entry. During the evaluation process, the ACI engine performs a string-based comparison to determine if the requester's identity matches the constraints defined in the SELFDN rule.\nWhen an anonymous LDAP client initiates a connection, the bind DN is effectively empty. If a target entry contains an empty or unset attribute value used in a SELFDN check, the evaluator incorrectly equates the 'empty' state of the anonymous bind with the 'empty' state of the attribute.\nThis flawed equality check leads to a false positive in the authorization logic, causing the evaluator to return a success state for the ACI check. Consequently, the directory server treats the unauthenticated anonymous user as a successfully authenticated identity that satisfies the SELFDN constraint.\nThe attack flow proceeds as follows: First, the attacker identifies a directory object protected by a SELFDN-based ACI that relies on a specific attribute to define ownership or identity. Second, the attacker performs an LDAP operation (such as an ADD or MODIFY request) against this object while maintaining an anonymous session (no credentials). Third, the ACI evaluator processes the request, incorrectly maps the empty bind DN to the empty attribute value, and grants access based on the flawed match. Finally, the server executes the unauthorized operation as if the requester had the appropriate permissions.\nThis vulnerability bypasses the intended security perimeter for self-service directory management. An attacker can leverage this to modify directory entries, potentially leading to unauthorized data exposure, account manipulation, or privilege escalation within the directory tree. Because this flaw is inherent in the evaluation logic, no specialized protocol manipulation is required beyond standard LDAP requests. The vulnerability is effective against any deployment where SELFDN rules are implemented without supplementary verification of the authentication state."
}