# Protocol Smuggling over LDAP password field

ownCloud user_ldap password field lacks CRLF validation, letting an admin smuggle SMTP/Redis commands to internal services and achieve RCE.

- Payout: hidden
- Severity: low
- Program: ownCloud
- Found by: pabl00nicarres
- Disclosed: 2021-09-03
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1054282
- Library page: https://bugbountylibrary.com/r/h1%3A1054282
- Tags: area:web domain:web impact:internal-access impact:rce kind:bounty platform:hackerone sev:low tech:email tech:redis technique:source-review vuln:crlf-injection vuln:rce vuln:ssrf

**Target:** ownCloud user_ldap plugin LDAP password setting endpoint
**Root cause:** The LDAP password field is saved without stripping \r\n, unlike other LDAP settings which are validated. The stored value is later used in a plaintext protocol connection, so injected newlines break out into arbitrary protocol commands.
**Steps:**
1. Authenticate as admin and open LDAP configuration.
2. Intercept the request setting the LDAP password with a proxy to bypass URL encoding.
3. Inject CRLF-terminated payload, e.g. `_%2A1%0D%0A%248%0D%0Aflushall%0D%0A...` for Redis or SMTP commands separated by `%0D%0A`.
4. Trigger the LDAP bind so ownCloud connects to the target service with the crafted password.
5. For Redis: use `config set dir`/`dbfilename` + `save` to write a webshell, or `SLAVEOF` + `MODULE LOAD` for RCE, or write `authorized_keys`.
**How found:** Noticed other LDAP settings had newline validation while the password field did not, then hypothesized the stored password is passed raw into protocol connections to internal services.
**Exploitation:** Admin sets a malicious LDAP password containing CRLF and protocol commands. When ownCloud performs the LDAP bind against an internal SMTP/Redis service, the injected bytes are interpreted as native protocol commands, allowing email sending, webshell write to webroot, Redis master/slave module load RCE, or SSH key planting.
**Escalation:** Chains CRLF injection into SSRF-style access to internal Redis/SMTP, escalating from admin-only config to remote code execution via Redis module load or webshell write.
**Insight:** When a config field is later reused as a credential in an outbound protocol handshake, check whether it is validated like its siblings; a missing newline filter on one field can turn a bind into arbitrary protocol command injection against internal Redis/SMTP.