CVE-2022-XX910
This challenge covers the review of a CVE in a Java codebase and its patch
In this lab, you will be working with the ActiveDirectoryAuthority.java file from the Apache ManifoldCF project. The objective is to pinpoint vulnerabilities in the code by comparing it to the provided patch. The patch introduces improvements like escaping LDAP distinguished names and filters to prevent potential security issues. This exercise will enhance your skills in code review and understanding patches applied to mitigate security vulnerabilities.
The code primarily deals with establishing LDAP connections and retrieving user authorization data from an Active Directory. It features functionalities such as connecting to a domain controller, retrieving user SIDs, and managing LDAP sessions. Through this lab, you will see how small changes in code can significantly impact security and functionality. By analyzing both the original and patched code, you will gain insights into proper coding practices and the importance of escaping user inputs to prevent LDAP injection attacks.