JRaman655537 (Community Member) asked a question.
Hi,
We use JNDI LDAP Authentication for user authentication, in the below code
public static boolean authorizeLDAP(String UserLoginID , String Userpassword){
try {
Hashtable<String, String> env = new Hashtable<String, String>();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.STATE_FACTORIES, "UserStateFactory");
env.put(Context.OBJECT_FACTORIES, "UserObjectFactory");
env.put(Context.PROVIDER_URL, "LDAP Server");
env.put(Context.SECURITY_PRINCIPAL, UserLoginID + "@LDAPDOMAIN");
env.put(Context.SECURITY_CREDENTIALS, Userpassword);
env.put(LdapContext.CONTROL_FACTORIES, "com.sun.jndi.ldap.ControlFactory");
@SuppressWarnings("unused")
DirContext ctx = new InitialDirContext(env); // causing CWE 502 flaw
}catch(Exception e){
e.printStackTrace();
return false;
}
return true;
}
Is there a way to avoid the CWE 502 flaw? What do I need to do?
.png){kind=logo}
Hi @JRaman655537 (Community Member)
Veracode Static Analysis has picked up a CWE-502 vulnerability in this specific code, because the application here is attempting to connect and query an LDAP using untrusted data from user supplied input. JNDI supports the deserialization of objects from LDAP directories, which can lead to remote code execution and in often cases also JNDI Injection.
LDAP can be used to store Java objects by using several special Java attributes. There are at least two ways a Java object can be represented in an LDAP directory:
The decoding of these Java objects during runtime execution by the Naming Manager will result in remote code execution.
The main difference between a JNDI Injection in DirContext.lookup() and a “LDAP Entry Poisoning”, is that in the former, the attacker will be able to use its own LDAP server while in the latter, the attacker will need to poison an entry in the victim’s LDAP server and interact or wait for the application to retrieve the poisoned entry attributes.
The general recommendation is to validate any user supplied argument using a whitelist of valid characters . Post sanitization, please raise a mitigation by design and mitigate the flaw (https://docs.veracode.com/r/Propose_Mitigating_Factors_for_a_Flaw).
References:
https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf
https://www.veracode.com/blog/research/exploiting-jndi-injections-java
https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html
Thanks,
Sounderya
Hi JRaman655537,
I am facing similar issue. Can you please let me know how you resolved this? Thank you.