Merge pull request #2651 from ggolawski/java-ldap-injection

Java LDAP Injection (CWE-90)

Author: aschackmull

java/ql/src/Security/CWE/CWE-090/LdapInjection.qhelp

@@ -0,0 +1,63 @@
+<!DOCTYPE qhelp PUBLIC
+  "-//Semmle//qhelp//EN"
+  "qhelp.dtd">
+<qhelp>
+<overview>
+<p>If an LDAP query is built using string concatenation, and the
+components of the concatenation include user input, a user 
+is likely to be able to run malicious LDAP queries.</p>
+</overview>
+
+<recommendation>
+<p>If user input must be included in an LDAP query, it should be escaped to
+avoid a malicious user providing special characters that change the meaning
+of the query. If possible build the LDAP query using framework helper methods, for example
+from Spring's <code>LdapQueryBuilder</code> and <code>LdapNameBuilder</code>,
+instead of string concatenation. Alternatively, escape user input using an appropriate
+LDAP encoding method, for example: <code>encodeForLDAP</code> or <code>encodeForDN</code>
+from OWASP ESAPI, <code>LdapEncoder.filterEncode</code> or <code>LdapEncoder.nameEncode</code>
+from Spring LDAP, or <code>Filter.encodeValue</code> from UnboundID library.</p>
+</recommendation>
+
+<example>
+<p>In the following examples, the code accepts an "organization name" and a "username"
+from the user, which it uses to query LDAP.</p>
+
+<p>The first example concatenates the unvalidated and unencoded user input directly
+into both the DN (Distinguished Name) and the search filter used for the LDAP query.
+A malicious user could provide special characters to change the meaning of these
+queries, and search for a completely different set of values. The LDAP query is executed
+using Java JNDI API.
+</p>
+
+<p>The second example uses the OWASP ESAPI library to encode the user values
+before they are included in the DN and search filters. This ensures the meaning of
+the query cannot be changed by a malicious user.</p>
+
+<sample src="LdapInjectionJndi.java" />
+
+<p>The third example uses Spring <code>LdapQueryBuilder</code> to build an LDAP query. In addition to
+simplifying the building of complex search parameters, it also provides proper escaping of any
+unsafe characters in search filters. The DN is built using <code>LdapNameBuilder</code>, which also provides
+proper escaping.</p>
+
+<sample src="LdapInjectionSpring.java" />
+
+<p>The fourth example uses <code>UnboundID</code> classes, <code>Filter</code> and <code>DN</code>, to construct a safe filter and
+base DN.</p>
+
+<sample src="LdapInjectionUnboundId.java" />
+
+<p>The fifth example shows how to build a safe filter and DN using the Apache LDAP API.</p>
+
+<sample src="LdapInjectionApache.java" />
+</example>
+
+<references>
+<li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html">LDAP Injection Prevention Cheat Sheet</a>.</li>
+<li>OWASP ESAPI: <a href="https://owasp.org/www-project-enterprise-security-api/">OWASP ESAPI</a>.</li>
+<li>Spring LdapQueryBuilder doc: <a href="https://docs.spring.io/spring-ldap/docs/current/apidocs/org/springframework/ldap/query/LdapQueryBuilder.html">LdapQueryBuilder</a>.</li>
+<li>Spring LdapNameBuilder doc: <a href="https://docs.spring.io/spring-ldap/docs/current/apidocs/org/springframework/ldap/support/LdapNameBuilder.html">LdapNameBuilder</a>.</li>
+<li>UnboundID: <a href="https://ldap.com/2018/05/04/understanding-and-defending-against-ldap-injection-attacks/">Understanding and Defending Against LDAP Injection Attacks</a>.</li>
+</references>
+</qhelp>

java/ql/src/Security/CWE/CWE-090/LdapInjection.ql

@@ -0,0 +1,21 @@
+/**
+ * @name LDAP query built from user-controlled sources
+ * @description Building an LDAP query from user-controlled sources is vulnerable to insertion of
+ *              malicious LDAP code by the user.
+ * @kind path-problem
+ * @problem.severity error
+ * @precision high
+ * @id java/ldap-injection
+ * @tags security
+ *       external/cwe/cwe-090
+ */
+
+import java
+import semmle.code.java.dataflow.FlowSources
+import LdapInjectionLib
+import DataFlow::PathGraph
+
+from DataFlow::PathNode source, DataFlow::PathNode sink, LdapInjectionFlowConfig conf
+where conf.hasFlowPath(source, sink)
+select sink.getNode(), source, sink, "LDAP query might include code from $@.", source.getNode(),
+  "this user input"

java/ql/src/Security/CWE/CWE-090/LdapInjectionApache.java

@@ -0,0 +1,22 @@
+import org.apache.directory.ldap.client.api.LdapConnection;
+import org.apache.directory.api.ldap.model.name.Dn;
+import org.apache.directory.api.ldap.model.name.Rdn;
+import org.apache.directory.api.ldap.model.message.SearchRequest;
+import org.apache.directory.api.ldap.model.message.SearchRequestImpl;
+import static org.apache.directory.ldap.client.api.search.FilterBuilder.equal;
+
+public void ldapQueryGood(HttpServletRequest request, LdapConnection c) {
+  String organizationName = request.getParameter("organization_name");
+  String username = request.getParameter("username");
+
+  // GOOD: Organization name is encoded before being used in DN
+  Dn safeDn = new Dn(new Rdn("OU", "People"), new Rdn("O", organizationName));
+
+  // GOOD: User input is encoded before being used in search filter
+  String safeFilter = equal("username", username);
+  
+  SearchRequest searchRequest = new SearchRequestImpl();
+  searchRequest.setBase(safeDn);
+  searchRequest.setFilter(safeFilter);
+  c.search(searchRequest);
+}

java/ql/src/Security/CWE/CWE-090/LdapInjectionJndi.java

@@ -0,0 +1,34 @@
+import javax.naming.directory.DirContext;
+import org.owasp.esapi.Encoder;
+import org.owasp.esapi.reference.DefaultEncoder;
+
+public void ldapQueryBad(HttpServletRequest request, DirContext ctx) throws NamingException {
+  String organizationName = request.getParameter("organization_name");
+  String username = request.getParameter("username");
+
+  // BAD: User input used in DN (Distinguished Name) without encoding
+  String dn = "OU=People,O=" + organizationName;
+
+  // BAD: User input used in search filter without encoding
+  String filter = "username=" + userName;
+
+  ctx.search(dn, filter, new SearchControls());
+}
+
+public void ldapQueryGood(HttpServletRequest request, DirContext ctx) throws NamingException {
+  String organizationName = request.getParameter("organization_name");
+  String username = request.getParameter("username");
+
+  // ESAPI encoder
+  Encoder encoder = DefaultEncoder.getInstance();
+
+  // GOOD: Organization name is encoded before being used in DN
+  String safeOrganizationName = encoder.encodeForDN(organizationName);
+  String safeDn = "OU=People,O=" + safeOrganizationName;
+
+  // GOOD: User input is encoded before being used in search filter
+  String safeUsername = encoder.encodeForLDAP(username);
+  String safeFilter = "username=" + safeUsername;
+  
+  ctx.search(safeDn, safeFilter, new SearchControls());
+}