Lightweight Directory Access Protocol (LDAP) injections are arguably the most dangerous type of injection attack. The data accessed via LDAP is usually valuable and confidential.
LDAP is commonly used in web applications for authentication, authorization, and storing and retrieving confidential data. Users typically utilize this protocol to manage user accounts, organize groups of users within an organization, and synchronize files across multiple systems. Consequently, an attack on LDAP is an assault on the backbone of a web application.
The OWASP (Open Web Application Security Project) defines an LDAP injection as an attack that exploits web apps using LDAP for authentication and authorization purposes. An LDAP injection attack begins in an insecure app with un-sanitized LDAP statements input by a malicious user. These injected queries can then execute arbitrary commands, such as granting unauthorized permissions to modify LDAP tree content.
Understanding LDAP injection
LDAP injection attacks take many forms. A bad actor may try to view usernames and passwords stored in the database, add themselves as users with admin privileges, or bypass user authentication altogether. LDAP injection attacks can wreak havoc on companies. The LDAP allows access to names, usernames, passwords, email addresses, phone numbers, job titles, and user permissions. These are all at risk when bad actors exploit LDAP injection vulnerabilities.
The key vulnerability that puts an application at risk of LDAP injection is improperly processed user input. Applications that don’t sanitize or validate user input are open to LDAP injection attacks because of the structure
Read more