Repository navigation
[Go]: Add Improper LDAP Authentication query #762
Description
Query PR
Language
GoLang
CVE(s) ID list
CWE
CWE-287
Report
This query covers Improper LDAP Authentication, that con occur when an application uses user-supplied data to establish a connection to a LDAP server.
I used a dataflow configuration looking for UntrustedFlowSource flowing to the password used in LDAP binding.
In order to avoid false positives I used RegexpCheck and equalityAsSanitizerGuard as barriers. For equalityAsSanitizerGuard I have taken as an example the equalityAsSanitizerGuard used in SSRF query. The difference here is that the query will consider whether the string to be compared is empty or not (this should avoid several possible FP)
Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).
- Yes
- No
Blog post link
No response
Activity
jorgectf commentedon Jun 14, 2023
👋 @maikypedia
Thank you for your contribution!
This reminds me of github/codeql#5444, but using user-controlled data instead 🚀
What do you think about also adding an empty string as a source in your query (like this)?
maikypedia commentedon Jun 18, 2023
Hi 👋 @jorgectf, done here 😃 .
jorgectf commentedon Jun 21, 2023
🎉
Could you address github/codeql#13366 (comment)? It seems that your query should catch
UnauthenticatedBindinstead ofBind.maikypedia commentedon Jul 5, 2023
Hi @jorgectf , I didn't realize that in v3 empty password option with Bind is disabled, sorry for the inconvenience 😅
ghsecuritylab commentedon Jul 14, 2023
Your submission is now in status Closed.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
maikypedia commentedon Aug 26, 2023
Due to the fact that LDAP version 3 is not vulnerable, it will not be included in the query. However, the reviewer has said that it would make sense to add v2 to the query instead. 😄
maikypedia commentedon Sep 26, 2023
Sorry for the delay, it has already been rewritten :)
ghsecuritylab commentedon Sep 27, 2023
Your submission is now in status Test run.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
ghsecuritylab commentedon Oct 6, 2023
Your submission is now in status Query review.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
ghsecuritylab commentedon Nov 13, 2023
Your submission is now in status Final decision.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
ghsecuritylab commentedon Nov 13, 2023
Your submission is now in status Pay.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed
xcorail commentedon Nov 13, 2023
Created Hackerone report 2250587 for bounty 530077 : [762] [Go]: Add Improper LDAP Authentication query
ghsecuritylab commentedon Nov 13, 2023
Your submission is now in status Closed.
For information, the evaluation workflow is the following:
Initial triage > Test run > Results analysis > Query review > Final decision > Pay > Closed