LDAP Anonymous Authentication

Description

Without proper access control, executing an LDAP statement that contains a user-controlled value can allow an attacker to abuse poorly configured LDAP context

Examples

Insecure Code

$ENV.put(Context.SECURITY_AUTHENTICATION, "none");

Secure Code

$ENV.put(Context.SECURITY_AUTHENTICATION, "simple"); // with proper credentials

Remediation

Implement proper authentication and access control for LDAP connections, avoiding anonymous authentication

Rule Details

Field	Value
ID	CODE-0055
Category	Auth
Severity	MEDIUM
CWE	CWE-358
Confidence	HIGH
Impact	MEDIUM
Likelihood	MEDIUM
Exploitability	MODERATE
Tags	authentication, access control
OWASP	N/A

---