InspIRCd Security Advisory 2026-01

Summary

The LDAP modules before v4.11.0 do not escape user-provided values before using them in LDAP search filters. This vulnerability can be used to access an LDAP-restricted server (if ldapauth is used) or gain access to a LDAP-restricted operator account (if ldapoper is used) without knowing the correct username if the password of any user is known.

Thanks to Tristan who independently reported this vulnerability a few days after it was discovered.

Details

ldapauth

InspIRCd uses an LDAP search filter to find the user to authenticate as. If a user connects using an LDAP name containing special characters like \2a this will be interpreted as an escape sequence by the LDAP library. This can be used to either match against any user (*) or enumerate users (foo*).

The first result the search filter finds will be used as the user to authenticate against LDAP as allowing an attacker to enumerate commonly used passwords to try and gain access to the server.

It is not expected that this vulnerability will affect many users as LDAP is not used on many networks.

ldapoper

InspIRCd uses an LDAP search filter to find the oper account to authenticate as. If the configuration contains an operator account containing a special character like * it will be used unescaped in the search filter. This can be used to either match against any user (*) or enumerate users (foo*).

The first result the search filter finds will be used as the user to authenticate against LDAP as allowing an attacker to enumerate commonly used passwords to try and gain access to an operator account.

It is not expected that this vulnerability will affect many users as LDAP is not used on many networks and it requires a specific unusual server operator configuration.

Affected Versions

This vulnerability is present in the following releases:

It is also present in all older releases but these branches are no longer receiving security fixes.

This vulnerability is fixed in version 4.11.0. It is strongly recommended that all affected users upgrade.

If upgrading is not possible then the ldapauth and ldapoper modules should be temporarily unloaded.

If it is not possible to temporarily unload the ldapauth module then the following actions should be taken:

If it is not possible to temporarily unload the ldapoper module then make sure that no server operator accounts contain any of the following characters in <oper:name>: *\().

History

References