Tridge writes: Directory-controlled dnsHostName reaches a privileged remove_dc LDAP filter without escaping; a crafted value can redirect the single-result DNS service-account deletion during DC cleanup. - python/samba/remove_dc.py:234-249 - python/samba/remove_dc.py:278-286 - python/samba/remove_dc.py:382-405 - python/samba/netcmd/domain/demote.py:53-82 - python/samba/netcmd/domain/backup.py:659-667 Remaining uncertainty: No live AD schema/write-constraint test was run; validation assumes a malicious or compromised directory object can carry LDAP filter metacharacters in dnsHostName or equivalent replicated data. #### Dataflow - Attacker role: Delegated directory administrator, compromised DC, or replicated directory state able to place LDAP filter metacharacters in the target server object dnsHostName. - Entrypoint: Administrative DC-removal flows: samba-tool domain demote --remove-other-dead-server and domain backup restore cleanup call remove_dc(). - Trust boundary: Directory-stored server attributes cross into a privileged SamDB cleanup search that can delete an account. Attacker outcome: Directory-controlled dnsHostName reaches a privileged remove_dc LDAP filter without escaping; a crafted value can redirect the single-result DNS service-account deletion during DC cleanup. #### Remediation Escape dnsHostName with ldb.binary_encode() before filter construction, validate hostnames against expected DNS syntax, and prefer DN/object identity checks before deletion. Add regression coverage that exercises the attacker-controlled input at the listed entry point and asserts the validation, authorization, containment, or size check occurs before the dangerous sink. | Severity | medium | | Confidence | high |
I agree we shouldn't trust LDAP in general, but DC objects are privileged and as written this is not a plausible attack. However when fixing these we might find an actually plausible issue not so far raised.
Created attachment 19114 [details] patch that escapes bad values in the dNSHostName > I agree we shouldn't trust LDAP in general, but DC objects are privileged and as written this is not a plausible attack. Agreed. I think we can escape the dns host name and close this as a non-security bug.
Removing embargo so reviewed patch can be submitted upstream.