LDAP injection
An editor has nominated this article for deletion. You are welcome to participate in the deletion discussion, which will decide whether or not to retain it. |
 | This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these messages)
|
In computer security, LDAP injection is a code injection technique used to exploit web applications which could reveal sensitive user information or modify information represented in the LDAP (Lightweight Directory Access Protocol) data stores.[1][2][3] LDAP injection exploits a security vulnerability in an application by manipulating input parameters passed to internal search, add or modify functions. When an application fails to properly sanitize user input, it is possible for an attacker to modify a LDAP statement.
Technical Implementation
Use of LDAP injection becomes possible when the web application does not properly sanitize user input. Without such filtering, a malicious user may inject input that becomes part of an LDAP search expression. Executing the expression may result in the user being able to view, modify, or bypass authentication credentials on the LDAP server.[1]
Prevention
LDAP injection is a known attack and can be prevented by simple measures. All of the client supplied input must be checked/sanitized of any characters that may result in malicious behavior. The input validation should verify the input by checking for the presence of special characters that are a part of the LDAP query language, known data types, legal values, etc.. White list input validation can also be used to detect unauthorized input before it is passed to the LDAP query.
References
- ^ a b Alonso, J. M.; Bordon, R.; Beltran, M.; Guzman, A. (1 November 2008). "LDAP injection techniques". 2008 11th IEEE Singapore International Conference on Communication Systems: 980–986. doi:10.1109/ICCS.2008.4737330. Retrieved 9 December 2016.
- ^ "The Web Application Security Consortium / LDAP Injection". projects.webappsec.org. Retrieved 9 December 2016.
- ^ Varanasi, Balaji. Practical Spring LDAP: Enterprise Java LDAP Development Made Easy. Apress. p. 97. ISBN 9781430263982. Retrieved 9 December 2016.