LDAP injection in CISA Thorium

Successful exploitation allows an authenticated remote attacker to alter LDAP authorization data, including group memberships. This can undermine authorization decisions and identity-to-role mappings within environments relying on LDAP-backed access control, potentially resulting in privilege escalation, unauthorized access to protected functionality, and compromise of trust in directory-backed authorization data.

If immediate upgrade is not possible, restrict access to authenticated interfaces that can influence LDAP query inputs, especially any functionality tied to LDAP user mapping or authorization updates. Limit privileges of the application account used to interact with LDAP so it cannot modify sensitive authorization attributes or group memberships beyond strict operational necessity. Increase monitoring and alerting for unexpected LDAP group membership changes and other authorization-data modifications until the fixed version can be deployed.

Upgrade CISA Thorium to version 1.1.1 or later, as the provided content states the vulnerability is fixed in 1.1.1. Review any custom code paths or integrations that construct LDAP queries from user-supplied input and ensure proper escaping or parameterization is applied consistently. After patching, audit LDAP authorization data, including group memberships, for unauthorized changes that may have occurred prior to remediation.