QID 150790
QID 150790: LDAP Error Detection
LDAP injection enables an attacker to modify the syntax of an LDAP query in order to retrieve, corrupt or delete data from the LDAP database. This is accomplished by manipulating query criteria in a manner that affects the query's logic. The typical causes of this vulnerability are lack of input validation and insecure construction of the LDAP query.
Queries created by concatenating strings with LDAP syntax and user-supplied data are prone to this vulnerability. If any part of the string concatenation can be modified, the meaning of the query can be changed.
The scope of a LDAP injection exploit varies greatly. If any LDAP statement can be injected into the query, the attacker has the equivalent access of an LDAP database administrator. This access could lead to theft of data, malicious corruption of data, or deletion of data.
All input received from the web client should be validated for correct content. If a value's type or content range is known beforehand, then stricter filters should be applied. For example, an email address should be in a specific format and only contain characters that make it a valid address, or numeric fields like a U.S. zip code should be limited to five digit values.
LDAP injection exploits can be mitigated by the use of Access Control Lists or role-based access within the database. For example, a read-only account would prevent an attacker from modifying data, but would not prevent the attacker from viewing unauthorized data. Table and row-based access controls potentially minimize the scope of a compromise, but they do not prevent exploits.
CVEs related to QID 150790
| Advisory ID | Software | Component | Link |
|---|