A Comprehensive Guide to LDAP Injection

LDAP Injection is one of the most common and dangerous web application security vulnerabilities that can expose sensitive user information or modify data stored in LDAP (Lightweight Directory Access Protocol) servers. LDAP is a protocol that allows applications to access and manage directory information services over a network. It is widely used by organizations to store user credentials, preferences, roles, and other data.

However, if web applications that use LDAP servers do not properly sanitize user input, they can be vulnerable to LDAP Injection attacks. In this article, we will explain what LDAP Injection is, how it works, how to prevent it, and how to detect and test for it. By the end of this article, you will have a comprehensive understanding of this critical security issue and how to protect your web applications from it.

How LDAP Injection works

LDAP Injection occurs when user input is not properly sanitized and then used as part of a dynamically generated LDAP filter. An LDAP filter is a string that specifies the criteria for searching or modifying entries in an LDAP server. For example, an LDAP filter can be used to authenticate a user by checking their username and password against the stored values in the server.

However, if an attacker can inject malicious characters or commands into the user input, they can modify the LDAP filter and execute arbitrary queries on the server. This can result in viewing, modifying, or bypassing authentication credentials, as well as performing other malicious actions on the server.

For example, consider the following code snippet that constructs an LDAP filter based on user input:

String filter = "(& (USER = " + username + ") (PASSWORD = " + password + "))";

In a normal scenario, a user would provide their username and password and this filter would be used to validate their credentials. However, an attacker can enter a crafted input for the username variable such as johnDoe) (&) and any value for password. The resulting filter will then become:

(& (USER = johnDoe) (&)) (PASSWORD = pass))

Only the first portion of this filter is processed by the LDAP server (& (USER = johnDoe) (&), which always evaluates to true allowing the attacker to gain access to the system without needing to provide valid credentials.

The same advanced exploitation techniques available in SQL Injection can be similarly applied in LDAP Injection, such as blind injection, error-based injection, union-based injection, etc.

LDAP injection prevention

LDAP Injection is a known attack and can be prevented by simple measures. The most important and effective way to prevent LDAP Injection is to perform input validation on all user-supplied data before using it in an LDAP filter. Input validation should check for the presence of special characters that are part of the LDAP query language, such as *, (, ), &, |, !, etc. and either reject, encode, or escape them.

Another way to prevent LDAP Injection is to use parameterized queries instead of dynamically constructing LDAP filters. Parameterized queries separate the user input from the query structure and prevent the input from being interpreted as part of the query. For example, using Java JNDI API, a parameterized query can be written as:

String filter = "(& (USER = {0}) (PASSWORD = {1}))";
Object[] filterArgs = new Object[]{username, password};
NamingEnumeration results = ctx.search("ou=People", filter, filterArgs, null);

In this case, the user input is passed as an array of objects and substituted into the filter at runtime. This prevents the input from modifying the filter structure and avoids LDAP Injection.

Detecting and testing for LDAP injection

Detecting and testing for LDAP Injection vulnerabilities in web applications can be done using various methods and tools, such as manual testing, automated scanners, fuzzing, and penetration testing.

Manual testing involves inspecting the source code of the web application and identifying the points where user input is used in LDAP filters. Then, using a proxy tool such as Burp Suite or ZAP, the tester can intercept and modify the HTTP requests and inject malicious characters or commands into the user input. If the response from the server indicates an error, a change in data, or a successful login without valid credentials, then the application is likely vulnerable to LDAP Injection.

Automated scanners are tools that can scan web applications for common vulnerabilities, including LDAP Injection. They can send various payloads to the application and analyze the responses for signs of vulnerability. Some examples of automated scanners are Acunetix, Nmap, Nikto, etc.

Fuzzing is a technique that involves sending random or malformed data to the web application and observing its behavior. Fuzzing can help discover unexpected errors or crashes that may indicate a vulnerability. Fuzzing tools can generate different types of data, such as strings, numbers, binary data, etc. Some examples of fuzzing tools are Peach Fuzzer, Sulley, Radamsa, etc.

Penetration testing is a process that involves simulating a real-world attack on a web application by a skilled and authorized tester. Penetration testing can help identify and exploit LDAP Injection vulnerabilities as well as other security issues that may not be detected by automated tools or manual testing. Penetration testing tools can help automate some aspects of the testing process, such as reconnaissance, scanning, exploitation, etc. Some examples of penetration testing tools are Metasploit, Nmap, Burp Suite, etc.

Conclusion

LDAP Injection is a serious web application security vulnerability that can compromise sensitive user information or data stored in LDAP servers. Web developers and security professionals should be aware of this threat and take appropriate measures to prevent it. Some of the best practices to prevent LDAP Injection are:

- Perform input validation on all user-supplied data before using it in an LDAP filter.
- Use parameterized queries instead of dynamically constructing LDAP filters.
- Encode or escape special characters that are part of the LDAP query language.
- Use secure coding standards and frameworks that prevent common vulnerabilities.
- Perform regular security testing and auditing on web applications using various methods and tools.