CWE Glossary

CWE is a trademark of the MITRE Corporation.

Stay in touch

Application security insights and invitations to exclusive events in your inbox


Your data will stay confidential Private and Confidential

LDAP Injection [CWE-90]

This weakness describes improper neutralization of special elements used in LDAP queries.

Created: February 23, 2013
Latest Update: August 5, 2015

Table of Content

  1. Description
  2. Potential impact
  3. Attack patterns
  4. Affected software
  5. Mitigations
  6. Severity and CVSS Scoring
  7. References

1. Description

This weakness describes a case where software does not properly validate external input before using it to construct LDAP queries. As a result, an attacker might be able to inject and execute arbitrary LDAP commands within the directory server.

Let's assume we have a simple front-end application that performs search in Active Directory on provided login and outputs information. Our script consist of two parts: html form and PHP code:
HTML form

  1. <form method="post" action="">
  2.         <p>Login: <input type="text" name="user" value=""></p>
  3.         <p>Password: <input type="password" name="pass" value=""></p>
  4.         <p>Search for: <input type="text" name="login"></p>
  5.         <input type=submit name="submit" value="Enter">
  6. </form>

PHP script
  1. <?
  2. ...
  3. $username = htmlspecialchars(trim($_POST["user"]));
  4. $upasswd = htmlspecialchars(trim($_POST["pass"]));
  5. $ldapbind = ldap_bind($ds, $username, $upasswd);
  6. if ($ldapbind):
  7. $filter="(&(objectClass=user)(sAMAccountName=".htmlspecialchars($_REQUEST["login"])."))";
  8. if (!($search=@ldap_search($ds, $ldapconfig['basedn'], $filter))) {
  9.         echo("Unable to search ldap server<br>");
  10.         echo("msg:'".ldap_error($ds)."'</br>");#check the message again
  11. }
  12. else {
  13.         $number_returned = ldap_count_entries($ds,$search);
  14.         $info = ldap_get_entries($ds, $search);
  15.         echo "<p>The number of entries returned is ". $number_returned."<p><pre>";
  16.         for ($i=0; $i<$info["count"]; $i++) {
  17.                 print_r($info[$i]);
  18.         }
  19.         echo "</pre>";
  20. }
  21. endif;
  22. ?>

The script is intended to output information on user account passed to $_REQUEST["login"] variable.

A regular LDAP query should look like:

(&(objectClass=user)(sAMAccountName=test_account))

The script however does not escape special symbols, which can be used by an attacker to abuse the functionality and perform arbitrary searches on directory server.

An attacker can modify the LDAP request and construct a new one by replacing the logon name with LDAP commands:

(&(objectClass=user)(sAMAccountName=*)(memberof=CN=Domain Admins,CN=Users,DC=testcompany,DC=local))

Once executed the script will return information on all administrative users in Active Directory.

In our scenario, this weakness can be used by attacker to access potentially sensitive information for later use in other attacks. For example, an attacker can enumerate user accounts and perform a brute-force attack or gain excessive knowledge of network infrastructure, quantity of computers and employees, etc.

2. Potential impact

Depending on the vulnerable application and its functionality, an attacker might be able to gain access to potentially sensitive information, modify or delete data and elevate privileges within the application. In a worst-case scenario this weakness could lead to full system compromise.

3. Attack patterns

Common Attack Pattern Enumeration and Classification (CAPEC) contains exploitation patterns for this weakness:


Alternative threat classification from WASC describes this weakness as an attack technique WASC-29 (LDAP Injection).

4. Affected software

Software that uses directory server to store and access information is potentially vulnerable to this weakness. Many corporate applications use SSO functionality based on LDAP and therefore should pay extra attention to security of such software.

5. Mitigations

Protection against LDAP injections requires accurate coding and secure server configuration.

Front-end applications should perform input validation and restrict all potentially malicious symbols. Developers can use regular expressions to validate untrusted input. The following regular expression can limit the scope of potential attacks by allowing only numbers and letters:

/[^0-9a-z]/i

Perform filtration of outgoing data as additional level of security. Do not output information that is not related to application’s functionality.

Implement correct access control on data within the LDAP directory, set appropriate permissions on user objects and disable anonymous access to directory objects.

6. Severity and CVSS Scoring

LDAP injections just like any other code injection weaknesses can influence confidentiality, integrity and availability of the application. Depending on application functionality and usage of LDAP queries, an attacker might be able to read, modify, delete information stored in directory server or even elevate privileges.

In case of information disclosure for unprivileged user, this weakness should be scored as:
5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N) – Medium severity.

In case of unauthorized data manipulation, this weakness should be scored as:
6.4 (AV:N/AC:L/Au:N/C:N/I:P/A:P) – Medium severity.

In case of privilege escalation, this weakness can be scored as:
7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) – High severity.

7. References

  1. CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') [cwe.mitre.org]
  2. Testing for LDAP Injection (OWASP-DV-006) [www.owasp.org]
  3. LDAP Injection and Mitigation [blogs.msdn.com]
  4. LDAP Injection: Are your web applications vulnerable? [PDF] [www.networkdls.com]

Copyright Disclaimer: Any above-mentioned content can be copied and used for non-commercial purposes only if proper credit to High-Tech Bridge is given.

↑ Back to Top
High-Tech Bridge on Facebook High-Tech Bridge on Twitter High-Tech Bridge on LinkedIn High-Tech Bridge RSS Feeds Send by Email
Share
Let's Talk