External risk intelligence

OpenLDAP back-sql SQL Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-29155

The vulnerability exists in the experimental back-sql backend of OpenLDAP. LDAP services are typically deployed for internal directory management rather than public-facing internet access. While network-reachable, the requirement for this specific experimental configuration makes widespread public internet exposure uncommon.

SQL Injection

Openldap

2.0 to before 2.5.122.6.0 to before 2.6.29.010.011.0

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in OpenLDAP's experimental SQL backend could allow an attacker to inject malicious SQL statements through specially crafted LDAP queries. This could potentially lead to unauthorized access or modification of sensitive data if an organization uses this specific, non-default configuration.

Allows database manipulation via LDAP queries.
Potentially impacts systems using experimental SQL backend.
Confirm if this specific configuration is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted LDAP query over the network. This query, when processed by OpenLDAP's experimental back-sql backend, would insert malicious SQL code into the database. This could allow an attacker to read, modify, or delete sensitive data.

No special access is required.
Triggered by an LDAP search operation.
Enables full database compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in OpenLDAP's experimental back-sql backend could allow an attacker to inject malicious SQL statements through an LDAP search query. This might occur when the search filter is not properly escaped, potentially affecting the integrity and availability of data managed by the back-sql backend.

Affects data managed by the back-sql backend.
SQL injection via unescaped LDAP search filters.
Could lead to data corruption or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

The SQL injection vulnerability in OpenLDAP's experimental back-sql backend likely impacts application owners and infrastructure teams responsible for directory services. The first practical step is to identify all instances of OpenLDAP, confirm if the back-sql backend is in use, and assess exposure and criticality.

Application owners should own the issue.
Verify if back-sql backend is enabled.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenLDAP?

OpenLDAP is a widely used, open-source software suite that implements the Lightweight Directory Access Protocol (LDAP). It serves as a centralized directory service, allowing organizations to manage user authentication, authorization, and network resources across their infrastructure. While primarily used for directory management, certain versions include an experimental feature known as 'back-sql' that bridges LDAP queries with traditional SQL databases.

How does the CVE-2022-29155 vulnerability work?

This vulnerability is a SQL injection flaw. It occurs because the experimental 'back-sql' component fails to properly sanitize or 'escape' characters when processing an incoming LDAP search filter. As a result, an attacker can craft a specific LDAP query that tricks the underlying backend into executing unintended SQL commands against the connected database, potentially exposing or altering data.

Do I need the back-sql feature enabled for this to be a risk?

Yes. The vulnerability is isolated to the 'back-sql' backend of the slapd server. If you are running standard OpenLDAP configurations that use typical storage backends, you are not susceptible to this specific flaw. The issue only exists when this optional, experimental module is actively configured and processing search operations.

Is my system likely at risk according to Halo Surface Signal?

Halo Surface Signal classifies the risk as unlikely. Because the vulnerability requires the use of a non-default, experimental backend, it is not a common configuration for most deployments. Furthermore, LDAP services are typically used for internal directory management, meaning they are rarely exposed directly to the public internet, which limits the potential attack surface.

What should I do if I run OpenLDAP?

Start by auditing your directory infrastructure to determine if the 'back-sql' backend is currently in use. If you find that this experimental module is active, verify your installed version of OpenLDAP against the affected ranges mentioned in the advisory. If your version is vulnerable, prioritize updating to a patched release or disabling the experimental backend to remove the risk entirely.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.