www.synopsys.com
Open in
urlscan Pro
23.222.134.19
Public Scan
URL:
https://www.synopsys.com/glossary/what-is-ldap-injection.html
Submission: On February 02 via manual from AU — Scanned from AU
Submission: On February 02 via manual from AU — Scanned from AU
Form analysis
0 forms found in the DOMText Content
Application Security Application Security | Build trust in your software * Support * About Us * * * English * 日本語 * 简体中文 close search bar Sorry, not available in this language yet close language selection * English * 日本語 * 简体中文 * Platform * Solutions * Tools & Services * Customer Success * Partners * Resources * Blog * Contact Sales Tools & Services go back Go Back INTEGRATED APPSEC SOLUTIONS * AppSec SaaS Platform * AppSec IDE Plug-ins * Application Security Posture Management * DevSecOps Integrations SOFTWARE RISK ANALYSIS * Static Analysis (SAST) * Software Composition Analysis (SCA) * Interactive Analysis (IAST) * Dynamic Analysis (DAST) * Penetration Testing * Protocol Fuzzing APPSEC PROGRAM SERVICES * Program Strategy & Planning * Threat & Risk Assessments * Security Training * Implementation & Deployment * Security Testing Services M&A DUE DILIGENCE * Open Source & Security Audits 2023 Gartner® Magic Quadrant™ for AppSec Testing See why Synopsys is a Leader * AppSec SaaS Platform | Integrated, cloud-based AST solution optimized for development and DevSecOps teams. * AppSec IDE Plug-ins | Secure code as you write it in your IDE * Software Risk Management | Manage application security programs at enterprise scale * DevSecOps Integrations | Integrate AppSec tools into DevOps workflows * Static Analysis (SAST) | Address security and quality defects in code as it's being developed * Software Composition Analysis (SCA) | Secure and manage open source risks in applications and containers * Interactive Analysis (IAST) | Automate web security testing within your DevOps pipelines * Dynamic Analysis (DAST) | Continuous web application security testing in production. * Penetration Testing | Identify business-critical vulnerabilities with on-demand testing expertise. * Protocol Fuzzing | Identify defects and zero-day vulnerabilities in services and protocols * Program Strategy & Planning | Measure, scale, and optimize your AppSec program * Threat & Risk Assessments | Understand and address internal and external security risks * Security Training | Equip development teams with the skills they need to produce more secure software * Implementation & Deployment | Optimize utilization, management and deployment of AppSec tools * Security Testing Services | On-demand AppSec testing resources and expertise * Open Source & Security Audits | Comprehensive technical due diligence services for M&A close sub navigation Application Security index Solutions go back Go Back MANAGE BUSINESS AND SOFTWARE RISK * Manage software risk at the speed your business demands 2023 Gartner® Magic Quadrant™ for AppSec Testing See why Synopsys is a Leader USE CASES * API Security Testing * Application Security Testing * DevSecOps * Software Supply Chain Security * Cloud & Container Security * Open Source Security & License Management * Malicious Code Detection * M&A Due Diligence * Quality & Security Standards Compliance BY ROLE * Dev and DevOps Teams * Security Teams * Legal Teams BY INDUSTRY * Financial Services * IoT & Embedded * Automotive * Telecommunications * Aerospace & Defense * Public Sector * Medical Device * Manage Software Risk | Manage software risk at the speed your business demands. * Dev and DevOps Teams | Build secure software while maintaining developer productivity and pipeline velocity. * Security Teams | Align people, processes, and technology to minimize software risk and transform your business. * Legal Teams | Solutions to protect your IP and manage risk. * API Security Testing | Manage software risks with a holistic API security testing program. * Application Security Testing | Solutions to address security risks at all stages of the application life cycle. * DevSecOps | Solutions to help shift security left without slowing down your development teams. * Software Supply Chain Security | Solutions to identify and manage software supply chain risks end-to-end. * Cloud & Container Security | Optimize your applications for secure deployment and operation in the cloud * Open Source Security & License Management | Effective solutions for ensuring open source security and license compliance * Malicious Code Detection | What hidden threats are lurking under the surface of your code? * M&A Due Diligence | Identify software risks that could negatively impact the value of acquired IP. * Quality & Security Standards Compliance | Ensure your software complies with the standards critical to customers and regulators * Financial Services | Protect sensitive customer and financial data from rapidly evolving security threats. * IoT & Embedded | Ensure your embedded and IoT devices are safe, secure, and reliable. * Automotive | Build software security & reliability into the modern connected car. * Telecommunications | Create seamless and safe mobile experiences, from silicon to software. * Aerospace & Defense | Solutions for automating mission-critical development. * Public Sector | Application security for government agencies and their suppliers. * Medical Device | Safeguard medical devices and applications. close sub navigation Application Security index Customer Success go back Go Back CUSTOMER SUCCESS * Our Commitment * Meet Your Team * Customer Testimonials SUPPORT * Submit a Ticket * Documentation * Customer Community * Product Education ADD-ON SERVICES * Premium & Designated Support * Implementation & Deployment * AppSec Training 2023 Gartner® Magic Quadrant™ for AppSec Testing See why Synopsys is a Leader * Our Commitment | Gain the confidence to implement, deploy, and grow with your AppSec tools * Meet Your Team | Achieve your AppSec goals with support from Synopsys experts. * Customer Testimonials | Application security customer success stories * Submit a Ticket | Visit our customer community for online support. * Documentation | Comprehensive user guides and how-to articles. <./li> * Customer Community | Search for answers, knowledge articles, tutorials, documentation, and more. * Product Education | Interactive courseware designed to help implement best practices for secure code. * Premium & Designated Support | Support with expedited response times and access to specialized technical, tactical, and operational knowledge. * Implementation & Deployment | Discover how to best utilize, manage, and deploy your application testing tools. * AppSec Training | Equip development teams with the skills they need to produce more secure software. close sub navigation Application Security index Resources go back Go Back APPLICATION SECURITY NEWS * Manage Security Risks * Build Security into DevOps * Secure the Software Supply Chain * Security News & Trends CONTENT LIBRARY * Case Studies * eBooks * Glossary * Reports * Webinars * White Papers CYBERSECURITY RESEARCH CENTER * Overview * Research NEWS ROOM * Press Releases 2023 Gartner® Magic Quadrant™ for AppSec Testing See why Synopsys is a Leader * Manage Security Risks News | Read the latest information on how to manage application security risks. * Build Security into DevOps News | Get insights from Synopsys on building security into DevOps. * Secure the Software Supply Chain News | Discover software supply chain risk management tips and best practices. * Security News & Trends | Get an analysis of today’s application security news and trends. * Case Studies | Application security customer stories * eBooks | Browse the latest ebooks on software security trends and best practices * Glossary | Glossary of Application Security, EDA & Semiconductor IP terms * Reports | Browse the latest application security reports from Synopsys and industry-leading analysts. * Webinars | Browse the latest webinars on application security solutions, trends, and strategies. * White Papers | Access the latest white papers for technical knowledge on application security solutions. * Overview | Learn more about the Synopsys Cybersecurity Research Center. * Research | Access the latest first-party research and analysis from the Synopsys Cybersecurity Research Center. * Press Releases | Browse our most recent news releases. close sub navigation Application Security index LDAP Injection | The 10 most common web and software application vulnerabilities ✕ * Home * Products A-Z * Silicon Design * Design * Verification Family * Synopsys IP * Application Security * Manufacturing Solutions * Simpleware 3D Image Processing * Optical Solutions * Photonic Solutions * Solutions * Aerospace & Government * AI & Machine Learning Solutions * Internet of Things * HPC & Data Center * Cloud * 5G * Memory * Multi-Die System Solution * RF Design * RISC-V * About Us * Newsroom * Community * Services * Support * Blogs * Careers * Events * Academic & Research Alliances * Webinars * Partners * Glossary * What is Design Planning? LDAP INJECTION The 10 most common web and software application vulnerabilities Table of Contents * What is LDAP injection? * How does LDAP injection work? * How can your organization defend against LDAP injection attacks? * What to read next DEFINITION Lightweight Directory Access Protocol (LDAP) is a common software protocol designed to enable anyone on a network to find resources such as other individuals, files, and devices. Directory services such as LDAP are useful for intranets. It can also be used to store usernames and passwords as part of a single sign-on (SSO) system. SOFTWARE VULNERABILITY SNAPSHOT The latest report highlights persistent vulnerabilities in web and software application security, including information disclosure/leakage, misconfigurations, and insufficient transport layer protection. The report also emphasizes the risks of vulnerable third-party libraries and the importance of software supply chain security. Read the report WHAT IS LDAP INJECTION? LDAP injection is a vulnerability in which queries are constructed from untrusted input without prior validation or sanitization. LDAP uses queries constructed from predicates that involve the use of special characters (e.g., brackets, asterisks, ampersands, or quotes). Metacharacters such as these control the meaning of the query; thereby, affecting the type and number of objects retrieved from the underlying directory. If an attacker can submit input containing these control characters, they can alter the query and change the intended behavior. -------------------------------------------------------------------------------- HOW DOES LDAP INJECTION WORK? The application architecture that supports LDAP includes both server-side and client-side components. The LDAP queries submitted to the server are known as LDAP search filters, which are constructed using prefix notation. Below is an example of an LDAP search filter: find("(&(cn=" + username +")(userPassword=" + pass +"))") This prefix filter notation instructs the query to find an LDAP node with the given username and password. Consider a scenario where this query is constructed by appending the username and password strings obtained from an HTML form. If these user-controlled values are appended to the LDAP search filter without any validation or sanitization, a username and password value of ‘*’ changes the intended meaning of the query and returns a list of all users. Special characters other than ‘*’ can also create malicious queries. If the username value is set to ‘*)(cn=*))(|(cn=*’, the effective search filter becomes: find("(&(cn=*)(cn=*))(|(cn=*)(userPassword=" + pass +"))") The highlighted condition in the above query always evaluates to true. If this query is used within an authentication flow, an attacker can easily bypass authentication controls with the above payload. There are a multitude of LDAP injection exploits that can be executed against a vulnerable server. Additionally, LDAP servers often store information such as users, roles, permissions, and related objects provisioned to them which, if compromised, can be devastating. -------------------------------------------------------------------------------- HOW CAN YOUR ORGANIZATION DEFEND AGAINST LDAP INJECTION ATTACKS? LDAP injection attacks primarily occur due to missing or weak input validation. Validation consists of rejecting malformed input or stripping malicious LDAP control characters before including untrusted input within a query. Below are several actionable methods you can leverage to protect your organization: Enforce input validation. Prior to including untrusted input in LDAP queries, the input should be validated against a prefer list of allowed strings or characters. This validation should always be conducted server-side even if the input is previously validated client-side. Structured inputs like social security numbers, phone numbers, and email addresses can be validated using a strong regular expression pattern. Inputs like usernames should be validated against an approved set of characters that exclude LDAP filter control characters. Escape input with encoding. Escape user-controlled input strings in such a way that any control characters in the input don’t change the intended meaning of the LDAP search filter. For example, in a Java application, metacharacters in an LDAP query can be prepared with backslashes as escape characters. With this method, untrusted inputs are appended to a search filter are as literal string values, not as LDAP predicates. Harden directory authorization. This defense technique is meant to minimize the impact of any injection attempt by employing the principle of least privilege. The LDAP account used for binding the directory in an application must have restricted access. With this approach, only authorized LDAP queries can be executed against the LDAP server. CONTINUE READING Solution FUZZ TESTING Uncover defects and zero-day vulnerabilities in services and protocols Learn more Solution SOFTWARE SECURITY TRAINING Accelerate application security testing education with on-demand resources and expertise Learn more Datasheet LDAP SERVER TEST SUITE Learn LDAP server implementations for security flaws and robustness problems. Learn more QUESTIONS ABOUT APPLICATION SECURITY? Contact us FOOTER CORPORATE * About Us * Careers * ESG * Inclusion & Diversity * Investor Relations * View our Office Locations * Contact Us PRODUCTS * Application Security * Semiconductor IP * Verification * Design * Silicon Engineering RESOURCES * Solutions * Services * Support * Community * Academic & Research Alliances (SARA) * Manage Subscriptions LEARN * Blogs * Press Releases * Newsroom * What is EDA? * What is Application Security? LEGAL * Privacy * Trademarks & Brands * Software Integrity Agreements * Security FOLLOW * * * * * FOLLOW * * * * * ©2024 Synopsys, Inc. All Rights Reserved COOKIE PREFERENCE CENTER * YOUR PRIVACY * STRICTLY NECESSARY COOKIES * FUNCTIONAL COOKIES * PERFORMANCE COOKIES * TARGETING COOKIES YOUR PRIVACY When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. More information STRICTLY NECESSARY COOKIES Always Active These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. Cookies Details FUNCTIONAL COOKIES Always Active These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. Cookies Details PERFORMANCE COOKIES Always Active These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. Cookies Details TARGETING COOKIES Always Active These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. Cookies Details Back Button BACK Vendor Search Filter Button Consent Leg.Interest checkbox label label checkbox label label checkbox label label * View Third Party Cookies * Name cookie name Clear checkbox label label Apply Cancel Save Settings Allow All