Skip to content

Missing authentication for critical function (LDAP)

Description

Without proper access control, executing an LDAP statement that contains a user-controlled value can allow an attacker to abuse poorly configured LDAP context

Examples

Insecure Code

kotlin
Context.SECURITY_AUTHENTICATION = "none"

Secure Code

kotlin
Context.SECURITY_AUTHENTICATION = "simple"

Remediation

Configure authentication for LDAP connections by setting the security authentication to a suitable method, such as simple or strong authentication

Rule Details

FieldValue
IDCODE-0325
CategoryAuth
SeverityMEDIUM
CWECWE-306
ConfidenceHIGH
ImpactMEDIUM
LikelihoodMEDIUM
ExploitabilityMODERATE
Tagsauthentication, ldap
OWASPA2:2017-Broken Authentication, A07:2021-Identification and Authentication Failures