Attack Chain

1. The attacker identifies a Maddy instance configured to use LDAP authentication with the auth.ldap module and either the filter or dn_template directive enabled.
2. The attacker connects to the Maddy instance's SMTP submission port (587) or IMAP port (993/143).
3. The attacker initiates the authentication process (AUTH PLAIN for SMTP, LOGIN for IMAP).
4. The attacker crafts a malicious username containing LDAP injection payloads (e.g., user)(attribute=value*)) to bypass authentication or extract information.
5. The crafted username is passed to the vulnerable strings.ReplaceAll() function in internal/auth/ldap/ldap.go without proper sanitization.
6. The unsanitized username is incorporated into an LDAP query or DN string, modifying the query's behavior.
7. If the injected filter allows, the attacker successfully authenticates as another user or extracts sensitive information via boolean-based blind injection.
8. The attacker leverages successful LDAP injection to spoof identities, enumerate the LDAP directory, or exfiltrate user attributes.

Impact

Successful exploitation of this vulnerability can lead to significant consequences. Attackers can spoof identities and potentially gain unauthorized access to resources. LDAP directory enumeration allows attackers to discover sensitive information about users and the directory structure. The ability to extract attribute values, including password hashes, further compromises the security of the system. All maddy deployments using the auth.ldap module with the filter or dn_template directive are vulnerable, affecting both SMTP submission and IMAP authentication. This issue is tracked as CVE-2026-40193 and has a high severity rating.

Recommendation

• Upgrade to Maddy version 0.9.3 or later to patch the vulnerability described in GHSA-5835-4gvc-32pc.
• Deploy the Sigma rule "Detect Maddy LDAP Injection Attempt via SMTP AUTH" to identify attempted exploitation via SMTP AUTH PLAIN.
• Enable detailed logging on the Maddy server, specifically capturing the usernames used during SMTP AUTH and IMAP LOGIN attempts, to facilitate investigation of potential LDAP injection attacks.
• If upgrading is not immediately feasible, consider disabling the auth.ldap module or implementing input validation to sanitize usernames before they are used in LDAP queries.