Anonymous Bind while using python-ldap Moduleâ
đ PY528
đˇī¸ missing_authentication
âšī¸ CWE-306
âī¸ Error
đ Professional Plan
This rule detects instances where the python-ldap module in Python is used to establish an LDAP connection with an anonymous bind. Anonymous binds can lead to security vulnerabilities as they allow access to the LDAP server without authentication, potentially exposing sensitive data and functionalities.
Exampleâ
import ldap
l = ldap.initialize("ldaps://ldap.example.com")
l.simple_bind_s("cn=root")
l.search_s("o=My Organization, c=US", ldap.SCOPE_SUBTREE, "objectclass=*")
Remediationâ
Only make connections to LDAP servers that require an authentication mechanism such as a user/password.
import ldap
ldap_user = input("LDAP user: ")
ldap_pass = getpass.getpass()
l = ldap.initialize("ldaps://ldap.example.com")
l.simple_bind_s(ldap_user, ldap_pass)
l.search_s("o=My Organization, c=US", ldap.SCOPE_SUBTREE, "objectclass=*")
False Positivesâ
In the case of a false positive the rule can be suppressed. Simply add a
trailing or preceding comment line with either the rule ID (PY528) or
rule category name (missing_authentication).
- Using rule ID
- Using category name
fix
import ldap
l = ldap.initialize("ldaps://ldap.example.com")
# suppress: PY527
l.simple_bind_s("cn=root")
l.search_s("o=My Organization, c=US", ldap.SCOPE_SUBTREE, "objectclass=*")
fix
import ldap
l = ldap.initialize("ldaps://ldap.example.com")
# suppress: missing_authentication
l.simple_bind_s("cn=root")
l.search_s("o=My Organization, c=US", ldap.SCOPE_SUBTREE, "objectclass=*")