This is LDAP injection in Apache Zeppelin's ActiveDirectoryGroupRealm, affecting versions 0.6.0 through 0.12.0. Two distinct paths are vulnerable: the user-search endpoint where attackers supply input before authentication completes, and the role-lookup query that runs after successful authentication. Both construct LDAP filters via string concatenation with unsanitized user input.
The CVSS 6.5 score badly understates the risk. In an Active Directory environment, LDAP is the organizational nervous system — an attacker injecting filter syntax isn't just enumerating usernames, they're mapping the privilege topology: user-group relationships, service account purposes, machine memberships, and trust chains. That mapping enables targeted lateral movement, not generic credential guessing.
What should concern operators most is the post-authentication injection vector. If an attacker already holds valid credentials, they can manipulate what the system believes about their authorization context by injecting LDAP filter logic during the role-lookup phase. That's not data exposure — that's the authentication layer itself becoming a pivot point for privilege escalation within your directory.
The vulnerability persisted across six versions because authentication code enters operational stasis: it works, it authenticates users, tests pass, and nobody questions its internals. The original developers likely weren't thinking about an authenticated attacker as a threat actor worth defending against — a common threat modeling gap in auth infrastructure.
For defenders: verify your Zeppelin version immediately. If you're on 0.6.0–0.12.0, upgrade to 0.12.1 or later. More importantly, examine the ActiveDirectoryGroupRealm configuration for similar patterns — the fix may have patched only the two identified vectors rather than refactoring to parameterized LDAP filters throughout. If it's the former, the underlying pattern likely still exists in the codebase and warrants a manual audit of all LDAP filter construction in authentication paths.