An unauthenticated attacker can achieve full account takeover in LDAP Tool Box Self Service Password 1.5.2 by exploiting a password reset mechanism flaw involving HTTP Host header injection.

The application is vulnerable to a password reset flaw (CWE-640) where it trusts the HTTP Host header to construct password reset links. An unauthenticated attacker can inject a malicious hostname into the header, causing the system to send reset tokens to a server under the attacker's control.

Successful exploitation allows unauthorized actors to reset the passwords of arbitrary users, leading to complete account takeover. This poses a severe risk to organizational security, as compromised accounts may grant access to sensitive directory services, internal applications, and private data. Given the CVSS score of 7.5, this high-severity vulnerability represents a significant risk to the confidentiality and integrity of user credentials.

Immediate Action: Update to the latest version of LDAP Tool Box Self Service Password to apply the security fix. If an update is not immediately feasible, verify the application configuration to ensure it does not rely on unsanitized user-supplied headers for URL generation.

Proactive Monitoring: Monitor web server access logs for anomalous HTTP Host headers, particularly those originating from unexpected domains or repetitive requests to the password reset endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) to validate and filter incoming HTTP Host headers, ensuring they match authorized and expected domain names before reaching the backend application.

Public Exploit Available: Yes, a functional exploit is available via Exploit-DB (EDB-ID 51275).

This vulnerability presents a clear and present danger to account security within the LDAP environment. Organizations utilizing version 1.5.2 of the LDAP Tool Box Self Service Password must prioritize upgrading to the latest patched version immediately. Failure to remediate this flaw exposes the organization to widespread account compromise and unauthorized access to identity management systems.