LDAP Filter Injection in 389 Directory Server Replication

CVE-2026-11770 exploits a critical input validation flaw in 389 Directory Server's CleanAllRUV replication operation. An unauthenticated attacker can inject malicious LDAP search filter syntax into the extended operation handler, which then executes queries against the cn=config directory with elevated replication plugin privileges. This allows attackers to extract sensitive metadata including replication bind DNs, password hashing schemes, and other server configuration details without authentication. Organizations running 389 Directory Server in replication scenarios face immediate risk, as the vulnerability requires no credentials and can be exploited remotely over standard LDAP ports.

Casky's security skills—powered by Claude AI's extended reasoning capabilities—map this vulnerability to MITRE ATT&CK technique T1059 (Command and Scripting Interpreter), detecting it as LDAP injection abuse for command execution and data exfiltration. When analyzing network traffic or application logs, practitioners would see findings flagging: unauthenticated LDAP requests with syntactically malformed or suspicious filter parameters targeting replication operations, boolean-based blind injection patterns in CleanAllRUV requests, and queries executed with unexpected privilege escalation. The skills would correlate these indicators with CWE-90 (Improper Neutralization of Special Elements used in an LDAP Query) to identify attempts to break out of intended query contexts. Security teams can then use these findings to hunt for exploitation attempts, validate patching status, and implement access controls restricting LDAP replication operations.