The Lightweight Directory Access Protocol (LDAP) allows an application to remotely perform operations such as searching and modifying records existing in directories. LDAP injection results from inadequate input sanitization and validation and allows malicious users to glean restricted information using the directory service.
A white - list can be used to restrict input to a list of valid characters. Characters that must be excluded from white-lists whitelists — including JNDI meta-characters metacharacters and LDAP special characters — are:
Character | Name |
|---|---|
' and " | Single and double quote |
/ and \ | Forward - slash and back-slashbackslash |
\ \ | Double slashes* |
space | Space character at beginning or end of string |
# | Hash character at the beginning of the string |
< and > | Angle brackets |
, and ; | Comma and semi-colonsemicolon |
+ and * | Addition and multiplication operators |
( and ) | Round braces |
\u0000 | Unicode NULL character |
...
| Code Block |
|---|
dn: dc=example,dc=com objectclass: dcobject objectClass: organization o: Some Name dc: example dn: ou=People,dc=example,dc=com ou: People objectClass: dcobject objectClass: organizationalUnit dc: example dn: cn=Manager,ou=People,dc=example,dc=com cn: Manager sn: John Watson # Several objectClass definitions here (omitted) userPassword: secret1 mail: john@holmesassociates.com dn: cn=Senior Manager,ou=People,dc=example,dc=com cn: Senior Manager sn: Sherlock Holmes # Several objectClass definitions here (omitted) userPassword: secret2 mail: sherlock@holmesassociates.com |
A search for a valid username user name and password often takes the form:
...
However, an attacker could bypass authentication by using S* for the USERSN field and * for the USERPASSWORD field. Such input would yield every record whose USERSN field began with S.
An authentication routine that permitted LDAP injection would allow unauthorized users to log in. Likewise, a search routine would allow an attacker to discover part or all of the data in the directory.
...
This noncompliant code example allows a caller of the method searchRecord() to search for a record in the directory using the LDAP protocol. The string filter is used to filter the result set for those entries that match a user name and password supplied by the caller. When a malicious user enters specially crafted input, as outlined abovepreviously, this elementary authentication scheme fails to confine the output of the search query to the information for which the user has access privileges.
...
This compliant solution uses a white-list whitelist to sanitize user input so that the filter string contains only valid characters. In this code, userSN may contain only letters and spaces, whereas a password may contain only alphanumeric characters.
...
When a database field such as a password must include special characters, it is critical to ensure that the authentic data is stored in sanitized form in the database and also that any user input is normalized before the validation or comparison takes place. We discourage use of characters that have special meanings in JNDI and LDAP in the absence of a comprehensive normalization and whitewhitelisting-listing based routine. Refer to the guideline VOID IDS04-J. Properly encode or escape output for examples on output encoding and escaping. Special characters must be transformed to sanitized safe values before they are added to the white-list whitelist expression against which input will be validated. Likewise, normalization of user input (escaping and encoding) should occur before the validation step.
...