Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap | maven | = 4.2.0 | 4.2.1 |
| org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap | maven | >= 4.1.0, < 4.1.6 | 4.1.6 |
| org.apache.cxf.services.xkms:cxf-services-xkms-x509-repo-ldap | maven | < 3.6.11 | 3.6.11 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the cxf-services-xkms-x509-repo-ldap component of Apache CXF, specifically within the LdapCertificateRepo class. The analysis of the security patch commit 2bfbf709c032d30429f3e22b2be3881979df6503 reveals that two methods, findBySubjectDn and saveCertificate, were constructing LDAP Distinguished Names (DNs) using unsafe string concatenation of user-controlled input. This practice allows for LDAP injection attacks.
The findBySubjectDn method took a string id and appended it to the rootDN to look up a certificate. An attacker could provide a crafted id to manipulate the resulting LDAP filter.
Similarly, the saveCertificate method, when dealing with PKIX applications, used an identifier from the UseKeyWithType object and concatenated it with the rootDN to create a DN for saving a certificate. This was also susceptible to injection.
The patch addresses these issues by introducing two new private methods, toPkixLookupDn and toPkixRegistrationDn. Both of these new methods utilize javax.naming.ldap.LdapName to parse and escape the provided identifiers. By using LdapName, the input is properly sanitized, ensuring that any special characters are treated as literals rather than LDAP control characters. The vulnerable functions findBySubjectDn and saveCertificate were updated to use these new sanitizing methods, effectively mitigating the LDAP injection vulnerability.
