GHSA-5835-4gvc-32pc Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username

• Go github.com/foxcpp/maddy: < 0.9.3 → fixed in 0.9.3

Summary The `auth.ldap` module constructs LDAP search filters and DN strings by directly interpolating user-supplied usernames via `strings.ReplaceAll()` without any LDAP filter escaping. An attacker who can reach the SMTP submission (AUTH PLAIN) or IMAP LOGIN interface can inject arbitrary LDAP filter expressions through the username field, enabling identity spoofing, LDAP directory enumeration, and attribute value extraction. The `go-ldap/ldap/v3` library—already imported in the same file—provides `ldap.EscapeFilter()` specifically for this purpose, but it is never called. Patched version Upgrade to maddy 0.9.3. Details Affected file: `internal/auth/ldap/ldap.go` Three locations substitute the raw, attacker-controlled `username` into LDAP filter or DN strings with no escaping: 1. `Lookup()` — line 228 (filter injection) ```go func (a *Auth) Lookup(_ context.Context, username string) (string, bool, error) { // ... req := ldap.NewSearchRequest( a.baseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 2, 0, false, strings.ReplaceAll(a.filterTemplate, "{username}", username), // /dev/null END=$(date +%s%N) ELAPSED=$(( (END - START) / 1000000 )) echo "char='$c' time=${ELAPSED}ms" done Characters with significantly longer response times indicate a filter match. ``` Impact Who is affected: Any maddy deployment that uses the `auth.ldap` module with either the `filter` or `dn_template` directive. Both SMTP submission (AUTH PLAIN) and IMAP (LOGIN) authentication are affected. What an attacker can do: 1. Identity spoofing: An attacker who knows any valid user's password can authenticate using an injected username that resolves to that user's DN via LDAP filter manipulation. The authenticated session identity (`connState.AuthUser` in SMTP, `username` passed to IMAP storage lookup) is the raw injected string, not the actual LDAP user. This can bypass username-based authorization policies downstream. 2. LDAP directory enumeration: By injecting wildcard filters (`*`) and observing error responses (e.g., "too many entries" vs. "unknown credentials"), an attacker can determine the number of users, probe for the existence of specific accounts, and discover directory structure. 3. Attribute value extraction via boolean-based blind injection: An attacker who holds valid credentials for any one LDAP account can inject additional filter conditions (e.g., `bob)(description=X*`) that turn the authentication response into a boolean oracle, and the same technique works via a timing side-channel. 4. DN template path traversal: When `dn_template` is used instead of `filter` (line 255), injected characters can manipulate the DN structure, potentially targeting entries in different organizational units or directory subtrees. Credit Yuheng Zhang, Zihan Zhang, Jianjun Chen and Teatime Lab LTD.