The cybersecurity firm F5 has identified and disclosed a critical zero-day vulnerability that affects the multi-cloud architecture NGINX Web Server. The flaw was first reported on by a cybersecurity group known as “BlueHornet,” after they tweeted about an experimental exploit for NGINX version 1.18. This vulnerability exists in the Lightweight Directory Access Protocol (LDAP) Reference Implementation. While LDAP doesn’t typically interact much with NGINX, there is an LDAP-auth daemon written in Python that runs parallel to NGINX, which communicates with LDAP authentication servers for users of proxied applications by NGINX. This is where the weakness lies, and if exploited, an attacker could send maliciously crafted HTTP request headers to override set configurations, and/or bypass user group memberships. These exploitation techniques force LDAP to authenticate the user, regardless of the status of their privileges. Although this is a critical vulnerability, new research shows that it only works under three (3) specific conditions: First, when command-line parameters are used to configure the Python daemon; second, when there are unused, optional configurations; and third, when the LDAP authentication depends on specific group membership. Further research also showed that this only affects the LDAP reference implementation and does not impact NGINX Open Source and NGINX Plus. There is currently no hard evidence that this flaw was exploited In-the-Wild; however, BlueHornet has alleged that the Chinese branch of UBS Securities and Royal Bank of Canada were breached, though neither claim has been verified. Although this is a zero-day, LDAP attacks are not uncommon, and administrators should have contingencies and mitigations for dealing with them as part of their standard security measures. The CEO of Viakoo, an enterprise IoT security platform, recommended that, “organizations running LDAP need to encrypt traffic using TLS certificates on IoT devices, have automated mechanisms to update IoT device firmware, and ensure the IoT device passwords are updated regularly and follow corporate policies.” The Ankura CTIX urges any NGINX-proxied application administrators, and NGINX Web Server maintainers to mitigate this vulnerability immediately using whatever mitigation technique is best for their specific environment.