Skip to content

Python: Add LDAP Improper Authentication query #5444

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
RasmusWL merged 32 commits into from
Jul 22, 2021
Merged

Python: Add LDAP Improper Authentication query #5444

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
32 commits
Select commit Hold shift + click to select a range
8715d29
Upload LDAP Improper authentication query, qhelp and tests
jorgectf Mar 18, 2021
809bf23
Move to experimental folder
jorgectf Mar 18, 2021
2f874c5
Precision warn and Remove CWE (broken) reference
jorgectf Mar 18, 2021
bfd4280
Fix imports and begin refactor
jorgectf Apr 6, 2021
db1f54a
Polish query file
jorgectf Apr 7, 2021
aa7763b
Set up Concepts
jorgectf Apr 7, 2021
8ca6e84
Refactor Calls to use ApiGraphs
jorgectf Apr 7, 2021
7e45649
Set up taint config and custom sink
jorgectf Apr 7, 2021
63bd323
Improve qhelp
jorgectf Apr 8, 2021
20fc5db
Polish query file
jorgectf Apr 8, 2021
2392be0
Improve sink
jorgectf Apr 8, 2021
015d203
Improve tests, move them and create qhelp examples
jorgectf Apr 8, 2021
1320eee
Add qlref
jorgectf Apr 8, 2021
5787406
Add .expected
jorgectf Apr 8, 2021
f140601
Write documentation
jorgectf Apr 8, 2021
ae806cd
Merge branch 'github:main' into jorgectf/python/ldapimproperauth
jorgectf May 7, 2021
1662c5d
resolve merge conflict
jorgectf Jun 14, 2021
d34d2ed
Add .qlref
jorgectf Jun 17, 2021
13cfcec
Change qhelp explanation
jorgectf Jun 17, 2021
5704ac3
Rework LDAP framework modeling
jorgectf Jun 17, 2021
9cbb7e0
Change query objective
jorgectf Jun 17, 2021
1d7ddce
Update .expected
jorgectf Jun 17, 2021
dfe16aa
Python: Handle both positional and keyword args for LDAP bind
RasmusWL Jun 28, 2021
b33f6a3
Python: Fix select for py/improper-ldap-auth
RasmusWL Jun 28, 2021
4a2c99a
Python: Inline `LDAPImproperAuth.qll`
RasmusWL Jun 28, 2021
5477b2e
Python: Minor refactoring cleanup
RasmusWL Jun 28, 2021
b942251
Rephrase .qhelp
jorgectf Jun 28, 2021
1d4d8ab
Fix tests
jorgectf Jun 28, 2021
1d432af
Update `.expected`
jorgectf Jun 28, 2021
2f9e645
Hardcode `ldap2` binding functions
jorgectf Jun 29, 2021
71e6db8
Merge branch 'main' into jorgectf/python/ldapimproperauth
RasmusWL Jul 22, 2021
42a997c
Python: Fix deprecation warning
RasmusWL Jul 22, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Improve qhelp
  • Loading branch information
@jorgectf
jorgectf committed Apr 8, 2021
commit 63bd32359a8bde41c67657d5b754e1cdc7fdd640
32 changes: 32 additions & 0 deletions python/ql/src/experimental/Security/CWE-287/ImproperLdapAuth.qhelp
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
<overview>
<p>If an LDAP query is built using string concatenation or string formatting, and it doesn't carry any kind of authentication,
anonymous binds causes an empty or None-set password to result in a successful authentication.</p>
</overview>

<recommendation>
<p>Use a strong password while establishing a LDAP connection to execute a query a user controls.</p>
</recommendation>

<example>
<p>In the following examples, the code accepts both <code>username</code> and <code>dc</code> from the user,
which it then uses to build a LDAP query and DN while the connection carries no authentication or binds anonymously.</p>

<sample src="examples/auth_bad_2.py" />
<sample src="examples/auth_bad_3.py" />

<p>In the third and fourth examples, the authentication is established using a password from a secure source such as environment variables.</p>

<sample src="examples/auth_good_2.py" />
<sample src="examples/auth_good_3.py" />
</example>

<references>
<li>SonarSource: <a href="https://rules.sonarsource.com/python/type/Vulnerability/RSPEC-4433">RSPEC-4433</a>.</li>
<li>Python2: <a href="https://www.python-ldap.org/en/python-ldap-3.3.0/reference/ldap.html">LDAP Documentation</a>.</li>
<li>Python3: <a href="https://ldap3.readthedocs.io/en/latest/">LDAP Documentation</a>.</li>
</references>
</qhelp>
28 changes: 0 additions & 28 deletions python/ql/src/experimental/Security/CWE-287/LDAPImproperAuth.qhelp
View file
Open in desktop

This file was deleted.