A critical LDAP injection vulnerability in the maddy mail server allows unauthenticated attackers to perform identity spoofing and unauthorized data extraction.

This flaw exists due to improper neutralization of special characters in LDAP queries within the auth.ldap module. An unauthenticated attacker can inject arbitrary LDAP filter expressions through the username field during authentication commands, bypassing standard security checks.

The vulnerability poses a severe risk to organizational security, as it facilitates identity spoofing and unauthorized access to directory information. With a CVSS score of 8.2, this high-severity flaw enables attackers to perform blind data extraction or enumerate sensitive LDAP attributes. Successful exploitation could lead to full account compromise and unauthorized access to internal mail systems, significantly impacting data confidentiality.

Immediate Action: Upgrade the maddy mail server to version 0.9.3 or later to incorporate the necessary LDAP filter escaping fixes.

Proactive Monitoring: Monitor SMTP and IMAP authentication logs for anomalous username strings or patterns that include LDAP meta-characters like asterisks, parentheses, or ampersands.

Compensating Controls: Implement strict rate limiting on authentication attempts and deploy a Web Application Firewall or proxy capable of inspecting and filtering suspicious traffic targeting the SMTP submission or IMAP interfaces.

Public Exploit Available: Unknown

Given the high CVSS score and the ability for unauthenticated actors to interact with the LDAP backend, immediate patching is required. Organizations running affected versions of maddy should prioritize the update to 0.9.3 to eliminate the injection vector and secure directory communications. Failure to address this vulnerability increases the risk of credential theft and unauthorized information disclosure within the mail infrastructure.