LDAP Injection Authentication Bypass


Lightweight Directory Access Protocol (LDAP) is used by web applications to access and maintain directory information services. One of the most common uses for LDAP is to provide a Single-Sign-On (SSO) service that will allow clients to authenticate with a web site without any interaction (assuming their credentials have been validated by the SSO provider). LDAP injection occurs when untrusted data is used by the web application to query the LDAP directory without prior sanitisation. This is a serious security risk, as it could allow cyber-criminals the ability to query, modify, or remove anything from the LDAP tree. It could also allow other advanced injection techniques that perform other more serious attacks. Scanner was able to detect a page that is vulnerable to LDAP injection based on known error messages. This injection was detected as scanner was able to bypass the authentication mechanism and access an authenticated page.

Products, Sensors, and Dependencies

ProductDependenciesData sourceAccess requiredProtocolData CollectedNotes
Tenable.io-WASWeb ApplicationsAuthenticated ScanHTTP/HTTPSLDAP InjectionPlugin ID: 113331


LDAP Injection Authentication Bypass

Attack Path Technique Details

Framework: OWASP

Family: Injection

Technique: LDAP Injection

Platform: Web Application

Products Required: Tenable.io-WAS

Tenable Release Date: 2022 Q2