AI analysis
Apache MINA SSHD, a Java SSH client/server library, contains an LDAP injection flaw (CWE-90) in its optional sshd-ldap component spanning versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Because the component fails to escape LDAP filter metacharacters, an unauthenticated attacker can authenticate to an affected SSH server by submitting a username of "*" and a password of "*", which causes the LDAP query to match unintended entries. A successful login grants the attacker a valid SSH session with high impact on confidentiality and integrity (CVSS 9.1), meaning potential access to whatever the server exposes — SFTP file trees, forwarded services, or shell access depending on the embedding application. Only SSH servers built on MINA SSHD that explicitly configure sshd-ldap for password or public key authentication are vulnerable; other MINA SSHD deployments are not affected. There is no known public proof-of-concept, the flaw is not on the CISA KEV list, and no in-the-wild exploitation has been reported.
What to do: Upgrade applications built on Apache MINA SSHD to version 2.20.0 or 3.0.0-M6, which escape LDAP filter parameters per RFC 4515. First confirm whether your application actually bundles and configures sshd-ldap for authentication — most MINA SSHD embedders do not and are unaffected. If patching is delayed, disable LDAP-backed password/public key auth in favor of another method, and review SSH authentication logs for login attempts using a literal "*" username, which would indicate probing for this flaw.
Affected
| Apache MINA SSHD (sshd-ldap component) | 1.2.0 to 2.19.0 |
| Apache MINA SSHD (sshd-ldap component) | 3.0.0-M1 to 3.0.0-M5 |
Estimated exposure
nicheunknown — likely a small subset of MINA SSHD-based deployments, since sshd-ldap is optional and rarely configured — No public install counts or internet-scan data exist for the optional sshd-ldap artifact; while MINA SSHD itself is widely embedded in Java applications and SFTP gateways, the vulnerable configuration requires deliberately enabling…
Description
Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for client-side and server-side SSH. The optional sshd-ldap component provides support for integrating password and publickey authentication on the server side with an LDAP server. sshd-ldap is an optional component. SSH servers implemented with Apache MINA SSHD are affected only if they use sshd-ldap and do configure it to be used for password of public key authentication. Other Apache MINA SSHD servers are not affected. Lack of escaping LDAP filter metacharacters enabled successful authentication with username "*" and password "*". Users are recommended to upgrade affected applications to version 2.20.0 or 3.0.0-M6, which fix this issue by properly escaping filter parameters according to RFC 4515.