Homarr Privilege Escalation Vulnerability via LDAP Injection

A privilege escalation vulnerability has been identified in Homarr, an open-source dashboard, in versions through 1.45.2. The issue arises from inadequate input sanitization in LDAP search queries, allowing malicious actors with access to a user account to escalate privileges and gain access to groups of other users. This vulnerability affects all instances using LDAP authentication.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing a user to access groups and permissions of other users.

Remediation

Users can upgrade to Homarr version 1.45.3 or later, which includes a patch for this vulnerability by validating LDAP input to prevent injection and ensuring that only one user matches the query. As a temporary workaround, LDAP authentication can be disabled, but this will prevent user login.