vCenter auth bypass at 9.8 tops a rough day for directory servers

A low-privilege domain user on a Samba AD DC can use LDAP filter injection to read sensitive Active Directory attributes that ACLs should block. In environments using Group Managed Service Accounts (gMSAs), an attacker can pull the root key data and derive gMSA passwords offline, which can lead to full domain compromise. CVSS 8.8, not yet exploited in the wild, but any authenticated domain user can pull this off.

Affected estate

Anyone running Samba as an Active Directory Domain Controller, especially with gMSAs configured

How to check

Run 'samba --version' on your AD DC hosts. Check if the AD DC role is active with 'samba-tool domain level show'.

Included because

authenticated but low-privilege; ACL bypass; can lead to domain compromise; common in Linux-based AD environments

Action

Upgrade Samba to the patched version. Rotate KDS root keys and gMSA passwords if gMSAs are in use.

Why it matters

Any authenticated domain user can extract secrets that lead to privilege escalation and full domain takeover.

Source

Samba security advisory

An unauthenticated remote attacker can crash 389 Directory Server by sending a crafted replication request with an oversized replica ID field. The overflow happens on the stack before any auth check. Stack protectors limit this to a denial-of-service crash rather than code execution, but if 389-ds is your primary LDAP/auth backend, a crash takes down authentication for everything that depends on it. CVSS 7.5.

Affected estate

Anyone running 389 Directory Server (389-ds-base), including Red Hat Directory Server and FreeIPA deployments

How to check

Run 'rpm -q 389-ds-base' or 'dnf info 389-ds-base' to check the installed version.

Included because

unauthenticated; network-accessible; denial of service; common identity infrastructure component

Action

Update 389-ds-base via 'dnf update 389-ds-base' or equivalent. Restrict replication port access to known replica peers.

Why it matters

A single crafted packet can crash your LDAP server, taking down authentication and directory services.

Source

Red Hat / 389 Directory Server advisory

An unauthenticated remote attacker can inject LDAP search filters into 389 Directory Server's CleanAllRUV replication status handler. Because the handler runs with elevated replication plugin privileges and returns a boolean result, the attacker can extract sensitive config data like replication bind DNs and password storage scheme details through blind injection. CVSS 7.5. This is an information disclosure bug, not RCE, but the leaked data can feed further attacks against your replication infrastructure.

Affected estate

Anyone running 389 Directory Server (389-ds-base), including Red Hat Directory Server and FreeIPA deployments

How to check

Run 'rpm -q 389-ds-base' or 'dnf info 389-ds-base' to check the installed version.

Included because

unauthenticated; network-accessible; information disclosure of privileged config data; common identity infrastructure

Action

Update 389-ds-base via your package manager. Review replication bind DN credentials and rotate them after patching.

Why it matters

Leaked replication credentials and config metadata give attackers a foothold to compromise your directory replication topology.

Source

Red Hat / 389 Directory Server advisory

CentreStack before 17.4 has an unauthenticated XXE (XML External Entity) injection bug in the SharePoint storage configuration endpoint. An attacker can send a crafted request that makes the server fetch attacker-controlled XML, which then exfiltrates local files like Web.config out-of-band. That config file typically contains database credentials and crypto keys, so this is a straight path to full server compromise. CVSS 7.5, no auth required.

Affected estate

Anyone running CentreStack (Gladinet) versions before 17.4

How to check

Check the CentreStack version in the admin portal dashboard or look at the installed program version in Control Panel.

Included because

unauthenticated; internet-facing endpoint; credential exfiltration; no user interaction required

Action

Upgrade to CentreStack 17.4 or later. Rotate all secrets in Web.config (database credentials, encryption keys) immediately after patching.

Why it matters

An unauthenticated attacker can steal your config file containing database passwords and crypto keys, leading to full server compromise.

Source

CentreStack / Gladinet advisory