OpenDJ Flaw Risks Identity Impersonation

A recently disclosed security flaw in OpenDJ reveals a significant breakdown in how the server handles authorization identities during specific authentication processes. This vulnerability, identified as GHSA-p279-2cqp-84jg, affects the opendj-server-legacy package and carries a critical CVSS severity score of 9.6.

The Breakdown of Proxy Controls

The issue stems from the PlainSASLMechanismHandler, which handles SASL PLAIN bind operations. When this mechanism processes an authorization identity—often referred to as an authzid—that points to a different user, it performs an insufficient validation check. While the system confirms that a user possesses the proxied-auth privilege, it fails to evaluate the specific mayProxy access-control right.

This oversight creates a divergence between the SASL PLAIN path and other proxy mechanisms within the OpenDJ architecture. Standard operations, such as DIGEST-MD5 and GSSAPI, maintain stricter requirements that mandate both the possession of the proxied-auth privilege and the presence of a valid mayProxy scope grant.

Scope of the Security Impact

By failing to enforce the mayProxy check, the PlainSASLMechanismHandler permits an account holder with proxied-auth privileges to assume the identity of any resolvable non-root user. This bypass effectively ignores the access-control list (ACI) restrictions established by a deployment, allowing an attacker to impersonate directory users beyond the scope initially defined by system administrators. It is important to note that the Directory Manager or root identity remains protected from this specific method of escalation.

• Severity Rating: CVSS 9.6 (Critical)
• Affected Component: maven/org.openidentityplatform.opendj:opendj-server-legacy
• Patched Version: 5.1.2
• Error Code on Failure: INVALID_CREDENTIALS (49)

Remediation and Path Forward

To address this vulnerability, the project maintainers have updated the code to enforce the mayProxy scope check across all paths. This implementation uses a shared hasProxyAccess helper, ensuring consistency with the security logic used by DIGEST-MD5 and GSSAPI handlers. The fix ensures that the system returns an INVALID_CREDENTIALS response before password verification occurs, preventing unauthenticated clients from distinguishing whether a failure resulted from missing privileges or a lack of ACI grants.

For administrators managing affected systems, the primary recommendation is to update the software to version 5.1.2. Until an upgrade can be completed, the available workaround involves restricting or revoking the proxied-auth privilege for any accounts that do not strictly require it.

Implications for Identity Infrastructure

This vulnerability highlights how discrepancies in logic between authentication handlers can inadvertently widen the attack surface of directory services. Because the system previously allowed identity switching based solely on the proxied-auth privilege, any environment relying on that permission level for broad directory access effectively functioned with an incomplete security posture. Organizations using this version of OpenDJ should evaluate their current privilege assignments to align with the intended granularity of their ACI-based access models.