What is the LDAP injection attack?

Sometimes, web applications do not take proper precautions while processing user inputs and use the user inputs in the server without sanitizing them properly. Attackers take advantage of that to perpetrate code injection attacks. The LDAP injection attack is one such attack in which attackers exploit web applications that do not take proper precautions while processing user inputs and construct LDAP statements using unsafe user inputs. Let’s try to understand how the LDAP injection attack works and how to prevent it.

What is LDAP?

Suppose we are using an email client and want to look for an email address before sending an email. We can do that easily if the person is in the address book. But think of a big organization where thousands of employees are present. We want to look for the email address of someone to whom we have never sent an email before. This problem can be resolved efficiently using LDAP or Lightweight Directory Access Protocol.

In LDAP, an LDAP server is maintained, and an LDAP client can use LDAP APIs to contact the LDAP Server and access information. For example, if we want to search for the email address of a person named ‘John’ who lives in San Francisco, we would type in the information in the LDAP client program. The LDAP client will then contact the LDAP server using LDAP APIs and information will be retrieved.

LDAP is used for looking up not only contact information but also encryption certificates, pointers to printers, and other services on the network like single sign-on, where a single password is used to log in to all services in the organization. (What is Single Sign-On (SSO), and how does it work?)

LDAP is an application protocol and it is used to maintain distributed directory information services over an IP network. It indexes all the data related to some distributed internet directory in a simple tree hierarchy and retrieves them efficiently when required.

How does the LDAP injection attack work?

Suppose a web application of a company authenticates an employee with his username and password and gives access to sensitive applications. Now, the login page typically will have two boxes for username and password. The web application will take inputs from the employee and will authenticate the employee.

Suppose the web application creates an LDAP query string from the user inputs and makes corresponding LDAP queries to the server to get a response. Suppose the web application is vulnerable to LDAP injection attacks. It does not sanitize the user inputs properly before making the LDAP query …