CVE-2020-15813 : Security Advisory and Response

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers, potentially allowing attackers to bypass authentication mechanisms.

Understanding CVE-2020-15813

What is CVE-2020-15813?

Graylog versions prior to 3.3.3 do not properly validate SSL certificates for LDAP servers, enabling interception of network traffic and redirection to unauthorized LDAP servers.

The Impact of CVE-2020-15813

This vulnerability permits attackers to redirect traffic to unauthorized LDAP servers, circumventing Graylog's authentication mechanism.

Technical Details of CVE-2020-15813

Vulnerability Description

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers
Allows usage of an external user/group database stored in LDAP
Connection configuration permits unencrypted, SSL-, or TLS-secured connections
Graylog client code does not implement proper certificate validation

Affected Systems and Versions

Graylog versions before 3.3.3

Exploitation Mechanism

Attacker intercepts network traffic between Graylog and LDAP servers
Redirects traffic to a different LDAP server unnoticed due to lack of certificate validation

Mitigation and Prevention

Immediate Steps to Take

Upgrade Graylog to version 3.3.3 or newer
Implement SSL certificate validation for LDAP connections

Long-Term Security Practices

Regularly update Graylog and all related components
Enforce secure communication practices within the network

Patching and Updates

Apply patches and updates provided by Graylog to address the SSL certificate validation issue