LDAP bind credentials transmitted in plaintext (no TLS) #95

New Issue

2026-09-01T00:13:37-04:00

jared commented

2026-09-01 00:13:37 -04:00

Severity: Medium

api/user_avatar.php (~line 116) connects via ldap://$ldapHost:$ldapPort — never ldaps://, and there's no ldap_start_tls() call anywhere in the file or codebase. LDAP_BIND_PW (from .env) is sent over the wire unencrypted on every avatar fetch.

Impact: If LDAP_HOST isn't reached over an already-fully-trusted, isolated network segment, the bind password is sniffable by anything with visibility into that network path. Not currently logged anywhere (verified: the only error_log() on bind failure logs ldap_error()'s generic message, not the password), so this is purely a transport-security gap, not a credential-logging one.

Fix: Switch to ldaps:// (if the LDAP server supports it) or add an ldap_start_tls() call before binding, with LDAP_PORT/config updated accordingly.

**Severity:** Medium `api/user_avatar.php` (~line 116) connects via `ldap://$ldapHost:$ldapPort` — never `ldaps://`, and there's no `ldap_start_tls()` call anywhere in the file or codebase. `LDAP_BIND_PW` (from `.env`) is sent over the wire unencrypted on every avatar fetch. **Impact:** If `LDAP_HOST` isn't reached over an already-fully-trusted, isolated network segment, the bind password is sniffable by anything with visibility into that network path. Not currently logged anywhere (verified: the only `error_log()` on bind failure logs `ldap_error()`'s generic message, not the password), so this is purely a transport-security gap, not a credential-logging one. **Fix:** Switch to `ldaps://` (if the LDAP server supports it) or add an `ldap_start_tls()` call before binding, with LDAP_PORT/config updated accordingly.

jared added the priority/medium security labels 2026-09-08 10:15:50 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#95