CVE-2023-33201: Bouncy Castle Bc-java LDAP Vulnerability

CVE-2023-33201 Overview

CVE-2023-33201 is an LDAP injection vulnerability affecting Bouncy Castle for Java before version 1.74. The vulnerability specifically impacts applications that utilize an LDAP CertStore from Bouncy Castle to validate X.509 certificates. During the certificate validation process, Bouncy Castle inserts the certificate's Subject Name into an LDAP search filter without proper escaping, which enables attackers to manipulate LDAP queries through specially crafted certificate data.

Critical Impact

Attackers can exploit this LDAP injection flaw to manipulate LDAP queries during X.509 certificate validation, potentially gaining unauthorized access to sensitive directory information or bypassing certificate validation controls.

Affected Products

• Bouncy Castle bc-java versions prior to 1.74
• Applications using LDAP CertStore for X.509 certificate validation
• Java applications with Bouncy Castle cryptographic library dependencies

Discovery Timeline

• 2023-07-05 - CVE CVE-2023-33201 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-33201

Vulnerability Analysis

This LDAP injection vulnerability exists within the certificate validation workflow of Bouncy Castle's Java cryptographic library. When an application uses an LDAP CertStore to validate X.509 certificates, Bouncy Castle constructs LDAP search filters dynamically using the certificate's Subject Name. The vulnerable implementation fails to sanitize or escape special LDAP characters before incorporating user-controlled certificate data into the search filter.

LDAP injection occurs because attackers can craft certificates with malicious Subject Name values containing LDAP metacharacters such as *, (, ), \, and null bytes. These characters have special meaning in LDAP filter syntax and can alter the intended query logic when improperly escaped.

Root Cause

The root cause is improper input validation and missing output encoding in the X509LDAPCertStoreSpi.java class. The certificate Subject Name is directly concatenated into LDAP search filters without escaping LDAP special characters as defined in RFC 2254. This allows attacker-controlled input from certificate fields to break out of the intended filter context.

Attack Vector

The vulnerability is exploitable over the network without authentication or user interaction. An attacker can submit a specially crafted X.509 certificate containing LDAP injection payloads in the Subject Name field. When a vulnerable application processes this certificate through Bouncy Castle's LDAP CertStore validation, the malicious characters are interpreted as LDAP filter syntax, potentially allowing the attacker to:

1. Modify the LDAP search filter logic to bypass validation
2. Extract sensitive information from the LDAP directory
3. Enumerate directory entries through crafted filter manipulations

The security patch adds proper LDAP filter encoding by implementing an escape table for RFC 2254 special characters:

 
         return crlSet;
     }
+    private static String[] FILTER_ESCAPE_TABLE = new String['\\' + 1];
+
+
+    static {
+
+        // Filter encoding table -------------------------------------
+
+        // fill with char itself
+        for (char c = 0; c < FILTER_ESCAPE_TABLE.length; c++) {
+            FILTER_ESCAPE_TABLE[c] = String.valueOf(c);
+        }
+
+        // escapes (RFC2254)
+        FILTER_ESCAPE_TABLE['*'] = "\\2a";
+        FILTER_ESCAPE_TABLE['('] = "\\28";
+        FILTER_ESCAPE_TABLE[')'] = "\\29";
+        FILTER_ESCAPE_TABLE['\\'] = "\\5c";
+        FILTER_ESCAPE_TABLE[0] = "\\00";
+
+    }
+
+    /**
+     * Escape a value for use in a filter.
+     * @param value the value to escape.
+     * @return a properly escaped representation of the supplied value.
+     */
+    private String filterEncode(String value)

Source: GitHub BC-Java Commit

Detection Methods for CVE-2023-33201

Indicators of Compromise

• Unusual LDAP queries containing unescaped special characters (*, (, ), \) originating from certificate validation processes
• Certificates with abnormal Subject Name values containing LDAP metacharacters
• Unexpected LDAP search patterns or filter modifications in directory server logs
• Increased LDAP query failures or errors during certificate validation operations

Detection Strategies

• Monitor LDAP directory server logs for anomalous queries with injection patterns such as )(, *)(, or unexpected filter operators
• Implement application-level logging for certificate validation requests, capturing Subject Name values for analysis
• Deploy network-based detection rules to identify certificates with suspicious Subject Name fields containing LDAP special characters
• Use static analysis tools to identify usage of vulnerable Bouncy Castle versions in application dependencies

Monitoring Recommendations

• Enable verbose logging on LDAP directory servers to capture full query details during certificate validation
• Implement alerting on LDAP query patterns that deviate from expected certificate lookup formats
• Monitor for dependency scanner alerts identifying Bouncy Castle versions prior to 1.74
• Track certificate validation failures that may indicate attempted exploitation

How to Mitigate CVE-2023-33201

Immediate Actions Required

• Upgrade Bouncy Castle for Java to version 1.74 or later immediately
• Audit applications to identify those using LDAP CertStore for certificate validation
• Review LDAP server logs for any evidence of exploitation attempts
• Implement input validation on certificate fields at the application layer as defense in depth

Patch Information

Bouncy Castle has released version 1.74 which addresses this vulnerability by implementing proper LDAP filter encoding for certificate Subject Names. The fix adds a filterEncode method that escapes RFC 2254 special characters (*, (, ), \, and null bytes) before inserting values into LDAP search filters. Organizations should update their Bouncy Castle dependencies through their build system (Maven, Gradle, etc.) to the patched version.

For detailed patch information, refer to the GitHub BC-Java CVE-2023-33201 Wiki and the security commit.

Workarounds

• If immediate patching is not possible, consider disabling LDAP-based certificate validation and using alternative certificate stores
• Implement LDAP server-side input validation and query sanitization as an additional layer
• Restrict LDAP server permissions to limit the impact of potential injection attacks
• Deploy web application firewalls or LDAP proxies with injection detection capabilities

# Maven dependency update example
# Update pom.xml to use patched Bouncy Castle version
# Replace vulnerable version with 1.74 or later:
# <dependency>
#     <groupId>org.bouncycastle</groupId>
#     <artifactId>bcprov-jdk18on</artifactId>
#     <version>1.74</version>
# </dependency>

# Verify installed version
mvn dependency:tree | grep bouncycastle