Vulnerabilities in NGINX's LDAP Reference Implementation

NGINX published an advisory on three vulnerabilities in its LDAP reference implementation that can enable LDAP injection and authentication bypass when the non-production nginx-ldap-auth daemon is used (conditions include use of ngx_http_auth_request, python-ldap, and specific configuration patterns). NGINX Open Source and NGINX Plus are not affected unless the reference implementation is deployed; BlueHornet claims an experimental PoC and limited successful tests but those claims are unverified. NGINX recommends replacing the reference implementation with a production-grade LDAP integration and auditing deployments that match the specified vulnerable conditions.