CVE-2021-29156 PoC — Forgerock ForgeRock OpenAM 注入漏洞

Source

https://github.com/5amu/CVE-2021-29156

Associated Vulnerability

Title:Forgerock ForgeRock OpenAM 注入漏洞 (CVE-2021-29156)
Description:ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. For example, an unauthenticated attacker can perform character-by-character retrieval of password hashes, or retrieve a session token or a private key.

Description

Exploit for CVE-2021-29156

Readme

# CVE-2021-29156 done right

This Proof of Concept is realized because the other PoC publicly available is broken ✨

## Install

```
go install github.com/5amu/CVE-2021-29156@latest
```

## References

* [https://nvd.nist.gov/vuln/detail/CVE-2021-29156](https://nvd.nist.gov/vuln/detail/CVE-2021-29156)
* [https://portswigger.net/research/hidden-oauth-attack-vectors](https://portswigger.net/research/hidden-oauth-attack-vectors)
* [https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0](https://github.com/OpenIdentityPlatform/OpenAM/releases/tag/13.0.0)

File Snapshot


 [4.0K]  /data/pocs/7e782e9fa9f68c363de4ebd93ef81069ec11ac34
├── [4.0K]  CVE-2021-29156.go
├── [1.0K]  LICENSE
└── [ 570]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!