Is this really the version you are looking for? Kentico Xperience 8 Documentation is no longer updated. Use the switcher in the header to choose your product version.
LDAP is a protocol for accessing and modifying the directory services over TCP/IP. This protocol has many implementations. However, we will focus only on the Active Directory Lightweight Directory service in this topic, as it is used by Kentico.
The LDAP injection attacks are similar to SQL injection attacks in principle. The attacker tries to exploit a web application to construct a malicious LDAP statement. If the application does not sanitize the user input, the attacker may be able to execute various commands.
Original query | http://www.example.com/people_search.aspx?name=Andy)(zone=public) |
Malformed query | http://www.example.com/people_search.aspx?name=Andy)(zone=*) |
Effect: Using the malformed query, the attacker can obtain all user information of the user Andy, not only the public information as in the original query.
Original query | http://www.example.com/document.aspx?path=Documents&recursive=yes |
Malformed query | http://www.example.com/document.aspx?path=Documents|(level=*))&recursive=yes |
Effect: Using the malformed query, the attacker can obtain all documents, not only those he has permissions for in the original query.
The attacker can, for example, obtain user logins and employee information, achieve privilege elevation, or modify the content inside the LDAP tree.
In Kentico, LDAP is used during the authentication process via forms. The input data is not authenticated against a database, but against Active Directory. Therefore, this spot in the system is vulnerable to LDAP injection attacks. Knowing that, we have made sure, that the input data is correctly validated to prevent these attacks.
However, if you plan to create a custom web part which operates with the AD data, be sure to check and secure the input before sending the LDAP queries to the server. Good techniques are:
The required escape sequence depends on whether the user input is used to create the Distinguished Name or used as a part of the search filter.
Used in DN - escape using / is needed:
& | ! | | | = | < | > | , | + | - | " | ' | ; |
Used in filter - escape using {\ASCII} is needed:
( | {\28} |
) | {\29} |
\ | {\5c} |
* | {\2a} |
/ | {\2f} |
Null | {\0} |
It is also a good practice to include '\\' at the beginning of escaped character listings to prevent recursive replacements.