LDAP injection

Practice

In computer security , LDAP injection is a code injection technique used to exploit web applications that could disclose sensitive user information or modify information represented in the data LDAP (Lightweight Directory Access Protocol) stores. LDAP injection exploits a security vulnerability in an application by manipulating input parameters passed to internal search, add, or modify functions. When an application fails to properly sanitize user input, an attacker can alter the LDAP instruction.

Technical implementation

LDAP injection occurs when user input is not properly sanitized and is then used as part of a dynamically generated LDAP filter. This leads to possible manipulation of the LDAP statements executed on the LDAP server, allowing the viewing, modification, or bypassing of authentication credentials. ^[1]

Prevention

LDAP injection is a well-known attack and can be prevented with simple measures. All client-supplied input must be validated / sanitized of any characters that could lead to malicious behavior. Input validation should check the input for the presence of special characters that are part of the LDAP query language, known data types, permissible values, etc. ^[2] Whitelist input validation can also be used to detect unauthorized input before it is passed into the LDAP query.

Example

The example below constructs a query to verify a user's credentials for the purpose of logging into the system.

String filter = “(&(USER = ” + user_name + “) (PASSWORD = “ + user_password + “))”;

In a typical use case, the user will supply their credentials, and this filter will be used to verify those credentials. However, an attacker can enter specially crafted input for the variable

user_name

such as

johnDoe)(&)

and any value for the password, so the completed query becomes

(&(USER = johnDoe)(&))(PASSWORD = pass))

. The LDAP server processes only the first part of this query

(&(USER = johnDoe)(&)

, which always evaluates to true, allowing the attacker to gain access to the system without needing to provide valid user credentials.

LDAP injection

Technical implementation

Prevention

Example

See also

Comments

To leave a comment

Lectures and tutorial on "information security - Cryptography and Cryptanalysis. Steganography. Information protection"

Terms: information security - Cryptography and Cryptanalysis. Steganography. Information protection