LDAP NULL BASE Search Access
Medium Nessus Plugin ID 10722
SynopsisThe remote LDAP server may disclose sensitive information.
DescriptionThe remote LDAP server supports search requests with a NULL, or empty, base object. This allows information to be retrieved without any prior knowledge of the directory structure. Coupled with a NULL BIND, an anonymous user may be able to query your LDAP server using a tool such as 'LdapMiner'.
Note that there are valid reasons to allow queries with a NULL base.
For example, it is required in version 3 of the LDAP protocol to provide access to the root DSA-Specific Entry (DSE), with information about the supported naming context, authentication types, and the like. It also means that legitimate users can find information in the directory without any prior knowledge of its structure. As such, this finding may be a false-positive.
SolutionIf the remote LDAP server supports a version of the LDAP protocol before v3, consider whether to disable NULL BASE queries on your LDAP server.