Tridge writes:

A delegated PSO tooling caller can inject LDAP filter syntax into user_or_group, influence the first sAMAccountName search result, and make the tool link or unlink the PSO to an unintended DN.

- python/samba/netcmd/pso.py:680-695 accepts user_or_group and builds search_filter = "(sAMAccountName=%s)" % user_or_group.
- python/samba/netcmd/pso.py:701-709 adds res[0].dn to msDS-PSOAppliesTo.
- python/samba/netcmd/pso.py:740-755 repeats the unescaped lookup in unapply.
- python/samba/netcmd/pso.py:761-769 deletes res[0].dn from msDS-PSOAppliesTo.

Remaining uncertainty: No LDAP runtime proof was run. Practical abuse is bounded by the credentials used to run samba-tool and PSO modification ACLs; an unrestricted administrator can already target arbitrary accounts by exact name.

#### Dataflow

Attacker role: samba-tool PSO apply/unapply caller, delegated operator, or automation input source controlling the user_or_group argument while the command runs with credentials that can modify the PSO.

Entrypoint: cmd_domain_pwdsettings_pso_apply.run() and cmd_domain_pwdsettings_pso_unapply.run() accept positional user_or_group input.

Trust boundary: Management CLI or wrapper input crosses into an LDAP search whose first result controls a mutating msDS-PSOAppliesTo update.

Controls and counterevidence:
- check_pso_valid() verifies the selected PSO exists and is accessible.
- LDAP ACLs gate the final samdb.modify() operation.
- An unrestricted administrator can already choose arbitrary exact targets.
- The account value is not escaped with ldb.binary_encode() before filter construction.

Exploit steps:
1. Supply LDAP filter metacharacters in the user_or_group argument to a PSO apply or unapply operation.
2. The command builds (sAMAccountName=%s) directly from the argument and performs a subtree search.
3. The first returned DN is selected as target_dn.

Attacker outcome: A delegated PSO tooling caller can inject LDAP filter syntax into user_or_group, influence the first sAMAccountName search result, and make the tool link or unlink the PSO to an unintended DN.

#### Severity

Final severity is **low**. This is a real control gap with constrained impact, narrow deployment exposure, or incomplete proof of security consequence.

Counterevidence: The mutation is ACL-bound and requires credentials allowed to modify the PSO; fully privileged administrators can intentionally target arbitrary objects without injection.


#### Remediation

Escape user_or_group with ldb.binary_encode() or perform an exact, parameter-safe lookup before mutating msDS-PSOAppliesTo. Add regression coverage that exercises the attacker-controlled input at the listed entry point and asserts the validation, authorization, containment, or size check occurs before the dangerous sink.


| Severity | low |
| Confidence | medium |