CVE-2023-28857

Apereo CAS is an open source multilingual single sign-on solution for the web. Apereo CAS can be configured to use authentication based on client X509 certificates. These certificates can be provided via TLS handshake or a special HTTP header, such as “ssl_client_cert”. When checking the validity of the provided client certificate, X509CredentialsAuthenticationHandler performs check that this certificate is not revoked. To do so, it fetches URLs provided in the “CRL Distribution Points” extension of the certificate, which are taken from the certificate itself and therefore can be controlled by a malicious user. If the CAS server is configured to use an LDAP server for x509 authentication with a password, for example by setting a “cas.authn.x509.ldap.ldap-url” and “cas.authn.x509.ldap.bind-credential” properties, X509CredentialsAuthenticationHandler fetches revocation URLs from the certificate, which can be LDAP urls. When making requests to this LDAP urls, Apereo CAS uses the same password as for initially configured LDAP server, which can lead to a password leak. An unauthenticated user can leak the password used to LDAP connection configured on server. This issue has been addressed in version 6.6.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-200
• CWE-522

• https://apereo.github.io/2023/02/20/x509-vuln/Third Party Advisory
• https://github.com/apereo/cas/releases/tag/v6.6.6Release Notes
• https://securitylab.github.com/advisories/GHSL-2023-009_Apereo_CAS/Third Party Advisory
• https://apereo.github.io/2023/02/20/x509-vuln/Third Party Advisory
• https://github.com/apereo/cas/releases/tag/v6.6.6Release Notes
• https://securitylab.github.com/advisories/GHSL-2023-009_Apereo_CAS/Third Party Advisory

Published

Jun 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-28851Silverstripe Form Capture provides a method to capture simpl…5.4
• CVE-2023-28852GLPI is a free asset and IT management software package. Sta…4.8
• CVE-2023-28853Mastodon is a free, open-source social network server based …6.5
• CVE-2023-28854nophp is a PHP web framework. Prior to version 0.0.1, nophp …8.8
• CVE-2023-28855Fields is a GLPI plugin that allows users to add custom fiel…6.5
• CVE-2023-28856Redis is an open source, in-memory database that persists on…6.5
• CVE-2023-28858redis-py before 4.5.3 leaves a connection open after canceli…3.7
• CVE-2023-28859redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connec…6.5
• CVE-2023-2886Missing Origin Validation in WebSockets vulnerability in CBO…4.3
• CVE-2023-28862An issue was discovered in LemonLDAP::NG before 2.16.1. Weak…9.8
• CVE-2023-28863AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verifi…9.1
• CVE-2023-28864Progress Chef Infra Server before 15.7 allows a local attack…5.5