Affected: Netflix lemur

Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.

Affected: PyPI: lemur

## Description

### Overview

Lemur's LDAP authentication module (`lemur/auth/ldap.py`) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator.

### Vulnerable Code

**Location:** `lemur/auth/ldap.py`, `_bind()` method

**Filter 1 — User lookup (line ~161):** ```python ldap_filter = "userPrincipalName=%s" % self.ldap_principal ```

`self.ldap_principal` is derived directly from `args["username"]` submitted at `POST /auth/login` with no sanitization. The `ldap.filter.escape_filter_chars()` function is never called.

**Filter 2 — Active Directory group lookup (line ~189):** ```python groupfilter = "(&(objectclass=group)(member:1.2.840.113556.1.4.1941:={}))".format(userdn) ```

The `userdn` value is derived from the LDAP response to the first unsanitized query, making it potentially tainted as well.

### Impact

An authenticated LDAP user can:

1. Inject LDAP filter syntax into the username field during login 2. Manipulate the group membership query to return arbitrary groups 3. Be assigned the `admin` role or any other privileged role in Lemur 4. Gain unauthorized access to all certificates, private keys (via `/certificates/<id>/key`), and CA configurations 5. Issue certificates under any authority

### Exploitation Constraint

The `simple_bind_s()` call must succe…