Vulnerabilities of LDAP As An Authentication Service

Abstract

Lightweight Directory Access Protocol (LDAP) servers are widely used to authenticate users in enterprise level networks. Organizations such as universities and small to medium-sized businesses use LDAP for a variety of applications including e-mail clients, SSH, and workstation authentication. Since many organizations build dependencies on the LDAP service, a Denial-of-Service (DoS) attack to the service can cause a greater number of services disrupted. This paper examines the danger in the use of LDAP for user authentication by executing a DoS attack exploiting the TCP three-way handshake required when initializing a connection to an LDAP server

Deceptive directories and “vulnerable” logs: a honeypot study of the LDAP and log4j attack landscape

“…The authors present injection techniques by manipulating the filters used for searching the directory services. Obimbo et al present the risks of using LDAP as an authentication protocol by executing a DoS attack exploiting the TCP threeway handshake required for connection initialization with an LDAP server [4]. More recently, Jeitner et al presented techniques to inject malicious payloads to launch injection attacks on protocols like DNS, LDAP, and Eduroam [6].…”

“…However, over the years, there have been many vulnerabilities in LDAP that enable injection attacks, unauthorized access, and remote code execution capabilities [4]- [6]. As many enterprise applications use LDAP for authentication, attackers are highly motivated to exploit the protocol to gain unauthorized access into the targeted infrastructure.…”

Systematic Literature Review on the LDAP Protocol As a Centralized Mechanism for the Authentication of Users in Multiple Systems

“…Vulnerabilities of LDAP as an Authentication Service. [9] LDAP, Authentication service, Denial.of-service, SYN Flooding.…”

Securely Web-based Application for Construction Material Testing

“…Several methods [5][6][7][8][9][10][11][12] have been proposed to prevent the SQL injection attack to the web-based application. These include adding some parameterized strings to the SQL commands, using a virtual database connectivity drive or extracting the basic structure of a SQL statement, creating the unpredictable instances of the language, and combining the static application code analysis with runtime validation.…”