{"id":50935,"date":"2023-03-09T00:00:00","date_gmt":"2023-03-09T00:00:00","guid":{"rendered":"urn:uuid:36e53aae-8a1d-c32b-c121-86c4c9b2285e"},"modified":"2023-03-09T00:00:00","modified_gmt":"2023-03-09T00:00:00","slug":"how-to-avoid-ldap-injection-attacks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-to-avoid-ldap-injection-attacks\/","title":{"rendered":"How to Avoid LDAP Injection Attacks"},"content":{"rendered":"

<\/p>\n

<\/div>\n

Lightweight Directory Access Protocol (LDAP) injections are arguably the most dangerous type of injection attack<\/a>. The data accessed via LDAP is usually valuable and confidential.<\/p>\n

LDAP is commonly used in web applications for authentication, authorization, and storing and retrieving confidential data. Users typically utilize this protocol to manage user accounts, organize groups of users within an organization, and synchronize files across multiple systems. Consequently, an attack on LDAP is an assault on the backbone of a web application.<\/p>\n

The OWASP<\/a> (Open Web Application Security Project) defines an LDAP injection<\/a> as an attack that exploits web apps using LDAP for authentication and authorization purposes. An LDAP injection attack begins in an insecure app with un-sanitized LDAP statements input by a malicious user. These injected queries can then execute arbitrary commands, such as granting unauthorized permissions to modify LDAP tree content.<\/p>\n

Understanding LDAP injection<\/span><\/p>\n

LDAP injection attacks take many forms. A bad actor may try to view usernames and passwords stored in the database, add themselves as users with admin privileges, or bypass user authentication altogether. LDAP injection attacks can wreak havoc on companies. The LDAP allows access to names, usernames, passwords, email addresses, phone numbers, job titles, and user permissions. These are all at risk when bad actors exploit LDAP injection vulnerabilities.<\/p>\n

The key vulnerability that puts an application at risk of LDAP injection is improperly processed user input. Applications that don\u2019t sanitize or validate user input are open to LDAP injection attacks because of the structure of LDAP statements and queries.<\/p>\n

For example, let\u2019s say a piece of code validates a username by checking whether the field is empty:<\/p>\n

uName = Request.QueryString[“user”];<\/span><\/p>\n

Following this command, an if-statement returns a message asking the user to specify a valid value if the uName entry is null or empty. If the field has an entry, the code initializes the uName value to perform an LDAP query:<\/p>\n

DirectorySearcher s = new DirectorySearcher();
s.Filter = “(&(samAccountName=” + uName + “))”;<\/span><\/p>\n

This is critically insufficient and leaves the LDAP server in the hands of malicious agents. Someone could perform LDAP injection using the asterisk (*) wildcard character via the web app\u2019s URL:<\/p>\n

http:\/\/webapp\/default.aspx?user=*<\/span><\/p>\n

The resulting LDAP statement (samAccountName=*) will return every object with the appropriate samAccountName attribute.<\/p>\n

This simple example illustrates how LDAP injections work. Below are more examples of LDAP injection attacks using OR and AND operators, which are among the most common types.<\/p>\n

The OpenLDAP is a free, open-source implementation of LDAP. In this example, let\u2019s assume an OpenLDAP server\u2019s login page employs the usual username and password pair.<\/p>\n

When a user enters their credentials, the page sends the following LDAP query to the server:<\/p>\n

(&(USER=uName)(PASSWORD=pwrd))<\/span><\/p>\n

If an attacker knows a valid username, they can inject the following string into the user <\/b>field:<\/p>\n

validUname)(&))<\/span><\/p>\n

Now, anything they write in the password<\/b> field will bypass the security check. The LDAP statement that results is:<\/p>\n

(& (USER=validUname)(&))(PASSWORD=anyString))<\/span><\/p>\n

Due to the way it\u2019s structured, OpenLDAP only processes the first filter: (& (USER=validUname)(&). OpenLDAP will see that the username is valid and that the second filter is a boolean AND, which returns TRUE. This ultimately bypasses the login page.<\/p>\n

One typical use of the OR operator in an LDAP injection is in a resources explorer, which shows available resources in a system. Let\u2019s examine this proper query to check available resources.<\/p>\n

(|(type=R1)(type=R2))<\/span><\/p>\n

In this statement, R1 and R2 represent resource types. A malicious user can inject the following string into the LDAP statement:<\/p>\n

1)(uid=*)<\/span><\/p>\n

Now, this is the completed query:<\/p>\n

(|(type=R1)(uid=*))(type=R2))<\/span><\/p>\n

Once again, this exploits how the LDAP server processes filters and returns all R1-type resources in the database.<\/p>\n

Another common attack can elevate privileges by exploiting the AND operator. Let\u2019s assume a basic security level lets users access documents:<\/p>\n

(&(directory=docs)(security_level=basic))<\/span><\/p>\n

A malicious actor may enter this LDAP injection:<\/p>\n

docs)(security_level=*))(&(directory=docs<\/span><\/p>\n

This creates the following filter.<\/p>\n

(&(directory=docs)(security_level=*))(&(directory=docs)(security_level=low))<\/span><\/p>\n

The wildcard operator and the AND cause the LDAP server to ignore the second filter. Consequently, the attacker can access all security levels.<\/p>\n

Fortunately, the most effective ways to mitigate LDAP injection vulnerabilities are straightforward and usually readily accessible:<\/p>\n