Skip to main content

LDAP injection

Need​

Prevention of LDAP injection attacks

Context​

  • Usage of TypeScript for statically typed JavaScript development
  • Usage of Express for building web applications and APIs
  • Usage of ldapjs for LDAP (Lightweight Directory Access Protocol) operations in Node.js

Description​

Non compliant code​

import express from 'express';
import ldap from 'ldapjs';

const app = express();

app.get('/users', (req, res) => {
  const username = req.query.username;

  const client = ldap.createClient({
    url: 'ldap://localhost:389',
  });

  const baseDN = 'ou=users,dc=example,dc=com';
  const searchFilter = `(uid=${username})`; // Vulnerable: Untrusted data used to build the LDAP query

  const searchOptions = {
    scope: 'sub',
    attributes: ['uid', 'cn', 'email'],
  };

  client.search(baseDN, searchOptions, (err, searchRes) => {
    if (err) {
      console.error(err);
      return res.status(500).json({ error: 'Internal Server Error' });
    }

    const entries: any[] = [];

    searchRes.on('searchEntry', (entry) => {
      entries.push(entry.object);
    });

    searchRes.on('end', () => {
      client.unbind();
      return res.json(entries);
    });
  });
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

The vulnerability in the given code is LDAP injection.

In the code, the LDAP query is built using untrusted data, specifically the username parameter obtained from the request query string. The username value is directly interpolated into the search filter without any validation or sanitization. This can allow an attacker to manipulate the LDAP query and inject malicious LDAP statements.

An attacker could potentially modify the username parameter to include LDAP statements that can extract sensitive information from the LDAP server without proper authorization. For example, an attacker could provide a username value of *)(uid=*))(|(uid=*)) to bypass the search filter and retrieve all user records in the LDAP directory.

This vulnerability can lead to unauthorized access to sensitive information stored in the LDAP server, such as usernames, email addresses, or any other attributes exposed by the search filter.

To mitigate this vulnerability, it is recommended to avoid using untrusted data directly in LDAP queries. Instead, input validation and sanitization should be performed to ensure that the data used in the query is safe and does not allow for injection attacks.

Steps​

  • Sanitize and validate user input: Before using the username parameter in the LDAP query, sanitize and validate it to ensure it only contains the expected characters. This can help prevent LDAP injection attacks.
  • Use parameterized queries: Instead of directly concatenating the username parameter in the LDAP query, use parameterized queries or prepared statements to safely include user input in the query. This can help prevent LDAP injection by automatically escaping special characters.
  • Implement proper input validation: Validate the username parameter to ensure it meets the expected format and length. Reject any input that doesn't comply with the validation rules.
  • Limit privileges: Ensure that the LDAP user used by the application has limited privileges and can only access the necessary data. This can help mitigate the impact of a successful LDAP injection attack.
  • Regularly update dependencies: Keep the ldapjs library and other dependencies up to date to benefit from security patches and bug fixes.
  • Implement access controls: Implement access controls to restrict access to sensitive LDAP data and operations based on user roles and permissions.

Compliant code​

import express from 'express';
import ldap from 'ldapjs';

const app = express();

app.get('/users', (req, res) => {
  const username = sanitizeAndValidateInput(req.query.username); // Step 1: Sanitize and validate user input

  const client = ldap.createClient({
    url: 'ldap://localhost:389',
  });

  const baseDN = 'ou=users,dc=example,dc=com';
  const searchFilter = `(uid=${username})`;

  const searchOptions = {
    scope: 'sub',
    attributes: ['uid', 'cn', 'email'],
  };

  client.search(baseDN, searchOptions, (err, searchRes) => {
    if (err) {
      console.error(err);
      return res.status(500).json({ error: 'Internal Server Error' });
    }

    const entries: any[] = [];

    searchRes.on('searchEntry', (entry) => {
      entries.push(entry.object);
    });

    searchRes.on('end', () => {
      client.unbind();
      return res.json(entries);
    });
  });
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

function sanitizeAndValidateInput(input: string): string {
  // Implement input sanitization and validation logic here
  // Return the sanitized and validated input
  return input;
}

The fixed code addresses the vulnerability by implementing input sanitization and validation logic to ensure that untrusted data is not used to generate dynamic LDAP queries.

Here's a breakdown of the changes made in the code:

  1. The sanitizeAndValidateInput function is introduced to sanitize and validate the user input before using it in the LDAP query. This function is responsible for implementing the necessary sanitization and validation logic to ensure that the input is safe to use.

  2. In the route handler for the /users endpoint, the user input is passed through the sanitizeAndValidateInput function before being used in the LDAP query. This ensures that any potentially malicious input is sanitized and validated before being used in the query.

  3. The LDAP client is created using the ldap.createClient function, specifying the LDAP server URL.

  4. The base DN (Distinguished Name) and search filter are constructed using the sanitized and validated username. This ensures that only safe and authorized queries are executed.

  5. The search options are specified, including the search scope and attributes to retrieve.

  6. The LDAP search is performed using the constructed base DN, search filter, and search options. The search results are handled in the callback function.

  7. The search results are collected in the entries array by listening to the searchEntry event.

  8. Once the search is complete, the LDAP client is unbound and the search results are returned as a JSON response to the client.

By implementing input sanitization and validation, the fixed code ensures that untrusted data cannot modify the LDAP query and prevents the injection of LDAP statements to extract sensitive information without authorization.

References​

Last updated on