CVE-2023-4727 Fix token authentication bypass vulnerability

Previously the LDAPSecurityDomainSessionTable.sessionExists()
and getStringValue() were using user-provided session ID as
is in an LDAP filter which could be exploited to bypass token
authentication.

To fix the problem the code has been modified to escape all
special characters in the session ID before using it in the
LDAP filter.

Resolves: CVE-2023-4727

base/server/src/main/java/com/netscape/cmscore/session/LDAPSecurityDomainSessionTable.java

@@ -29,6 +29,7 @@
 import com.netscape.cmscore.apps.EngineConfig;
 import com.netscape.cmscore.ldapconn.LDAPConfig;
 import com.netscape.cmscore.ldapconn.LdapBoundConnFactory;
+import com.netscape.cmsutil.ldap.LDAPUtil;
 
 import netscape.ldap.LDAPAttribute;
 import netscape.ldap.LDAPAttributeSet;
@@ -173,7 +174,11 @@ public boolean sessionExists(String sessionId) throws Exception {
         try {
             String basedn = ldapConfig.getBaseDN();
             String sessionsdn = "ou=sessions,ou=Security Domain," + basedn;
-            String filter = "(cn=" + sessionId + ")";
+
+            // CVE-2023-4727
+            // escape session ID in LDAP search filter
+            String filter = "(cn=" + LDAPUtil.escapeFilter(sessionId) + ")";
+
             String[] attrs = { "cn" };
 
             conn = mLdapConnFactory.getConn();
@@ -254,7 +259,11 @@ private String getStringValue(String sessionId, String attr) throws Exception {
         try {
             String basedn = ldapConfig.getBaseDN();
             String sessionsdn = "ou=sessions,ou=Security Domain," + basedn;
-            String filter = "(cn=" + sessionId + ")";
+
+            // CVE-2023-4727
+            // escape session ID in LDAP search filter
+            String filter = "(cn=" + LDAPUtil.escapeFilter(sessionId) + ")";
+
             String[] attrs = { attr };
 
             conn = mLdapConnFactory.getConn();