Uyazi ukuba yintoni i-LDAP injection? Yindlela yokufaka ikhowudi ejolise kwizicelo ezakha imibuzo yokufaka kusetyenziswa igalelo lomsebenzisi elingacocekanga. I-LDAP (i-Lightweight Directory Access Protocol) isetyenziswa rhoqo ekukhangelweni kwee-directory, njengokuqinisekisa abasebenzisi okanye ukufumana idatha yentlangano. Xa abahlaseli bebonelela ngegalelo elenziwe ngokukodwa eliqulethe ii-metacharacters ze-LDAP, banokutshintsha indlela eqonda ngayo imibuzo ye-directory ukuze bafikelele okanye batshintshe idatha ngendlela engafanelekanga. Enyanisweni, ubuthathaka bokufaka i-LDAP buvela xa izihluzi zakhiwe ngokwamandla ukusuka kumaxabiso alawulwa ngumsebenzisi ngaphandle kokufaka i-sanitization okanye ukuqinisekiswa.
Indlela Esebenza Ngayo: Iindlela Zokuhlaselwa Ngenaliti ye-LDAP #
Uhlaselo lwe-LDAP ngenaliti lwenzeka xa idatha enikwe ngumsebenzisi ifakwa ngendlela engakhuselekanga kumbuzo we-LDAP. login kucoca:
(&(cn=” + igama lomsebenzisi + “)(userPassword=” + igama eligqithisiweyo + “))Ukuba umhlaseli uthumela ulandelelwano lwe-* okanye lwe-terminator endaweni yegama lomsebenzisi elisebenzayo, i-filter logic iyawa ibe luvavanyo olubanzi okanye imeko ehlala iyinyani, idlula ngokufanelekileyo ukuqinisekiswa. Le yindlela kanye le injection esebenza ngayo: ukufaka i-LDAP logic ukuguqula indlela yokuziphatha ebekiweyo.
Ngoko ke, ukuba sesichengeni kwe-LDAP injection kuvela ekwakheni imibuzo nge-input engathembekanga equka oonobumba abakhethekileyo, abanjengeebhrakhethi, iikowuteshini, kunye nee-wildcards, eziphinda zenze i-semantics yemibuzo.
Ngaphezu koko, zenzeka xa ikhowudi yesicelo ikopisha idatha yomsebenzisi ngokungenabungozi kwi-LDAP query kwaye ingaphumeleli ukwahlulahlula ii-metacharacters, ivumela abahlaseli ukuba baphazamise okanye baguqule i-query logic, bafikelele kwidatha engagunyaziswanga, okanye batshintshe ukuhamba komsebenzi.
Kutheni i-LDAP Injection Attack ibalulekile? #
Uhlaselo lwe-LDAP olufakwe kwi-injection lunokuphazamisa ukuqinisekiswa, luvuze ulwazi oluyimfihlo, okanye lutshintshe nolwakhiwo lwe-directory. I-Imperva igxininisa ukuba abantu abasongelayo banokubeka emngciphekweni iinkqubo zokuqinisekiswa, bajonge okanye batshintshe amagama abasebenzisi/amagama ayimfihlo, bafake i-malware, kwaye bandise amalungelo, nto leyo ekhokelela ekwaphulweni kwedatha, ekulimaleni kodumo, kunye nokulahlekelwa yimali.
Ubuthathaka bokufakwa kwe-LDAP bunokwanda ngeenkonzo ezidibeneyo, ingakumbi kwi enterprise iindawo ezisebenzisa i-LDAP yokungena kunye (i-SSO), ukugunyaziswa, okanye ukulungelelaniswa kobuwena bomsebenzisi kunye neemvume.
Iimpawu zoBungozi bokuNgenwa kwe-LDAP ekhoyo #
Kukhuseleko lwe-intanethi, ulawulo lubhekisa kwindlela ubunkokeli, imigaqo-nkqubo, kunye neembonakaliso ezibalulekileyo:
- Ikhowudi idibanisa igalelo lomsebenzisi ngqo kwiifilitha ze-LDAP.
- Ukungabikho kokuqinisekiswa okanye ukubaleka kwento engenisiweyo.
- Ukusetyenziswa koonobumba abakhethekileyo abanjengo () * kunye no | = ekufakweni ngaphandle kwemida.
- Iziphumo zombuzo ezingalindelekanga, umzekelo, ukuqinisekiswa kuyaphumelela nokuba ziziphi na iziqinisekiso, okanye uluhlu olubanzi lwabasebenzisi lubuya xa kufakwe okuncinci.
Imibuzo eyakhiwe ngendlela engafanelekanga evela kungeniso lomsebenzisi inokuvumela ukufunyanwa kwedatha engagunyaziswanga okanye ukudlula kwi-logic.
Ungazinciphisa njani?
Ukunciphisa ubuthathaka bokufakwa kwe-LDAP kubandakanya:
a. Ukuqinisekiswa kokufaka / uluhlu lokuvumela
Yamkela oonobumba okanye iipateni ezikhuselekileyo kuphela. Yala okanye ucoce oonobumba bolawulo abanjengo *, (, ), &, |, =. I-PortsWigger icebisa ukuvala ii-inputs eziqulethe ii-metacharacters ze-LDAP okanye ukunyanzelisa iipateni eziqinileyo ze-alphanumeric.
b. Ukubaleka/Ukubhala ikhowudi
Sebenzisa imisebenzi ethile ye-LDAP ethi escape: Distinguished Name escape kwi-DN contexts, kunye ne-search filter escape kwi-predicates. I-OWASP inika iinkcukacha ezineenkcukacha Iphepha lokukhohlisa lokuthintela elinesikhokelo esenzelwe wena
c. Imibuzo eneeParameterized / ii-API ezikhuselekileyo
Ziphephe ukwakha izihluzi ngokusebenzisa ukudibana kwemigca. Sebenzisa iilayibrari ze-LDAP ezixhasa ukubopha iiparameter okanye ii-API zokwakha izihluzi (umz., i-UnboundID SDK's Filter.createANDFilter(…)) ukuqinisekisa ukuba igalelo lomsebenzisi liphathwa njengedatha, hayi i-syntax.
d. Umgaqo weLungelo eliNcinci (PoLP)
Bopha i-LDAP ngamalungelo okufikelela amancinci. Nokuba kufakwe inaliti, ithintela izenzo ezinokwenziwa ngumhlaseli. Underscore PoLP idityaniswe ne zero-trust kunye ne-MFA ukunciphisa impembelelo.
e. IiNkqubo eziKhuselekileyo/Amathala eeNcwadi
Sebenzisa izikhokelo eziphuma ngokuzenzekelayo okanye ezicoca iingeniso kwaye zithintele ukwakhiwa kwemibuzo eluhlaza.
f. Izixhobo zoHlalutyo lweKhowudi
Kwi-.NET, sebenzisa uhlalutyo lwe-CA3005 ukuze ufumane igalelo le-HTTP elingathembekanga elifikelela kwiingxelo ze-LDAP; lungisa ngokucoca, ukubaleka, okanye ukuvumela igalelo lokufaka kuluhlu.
g. Uvavanyo (Uvavanyo oluzinzileyo, olutshintshatshintshayo, nolwepeni)
Hlanganisa zombini iStatic AppSec (SASTkunye neDynamic (DAST) ukuskena ukuze kubonwe ubuthathaka bokufakwa kwe-LDAP ngexesha lokuphumla nangexesha lokusebenza.
h. Ukugcina iirekhodi, ukubeka esweni, ukulumkisa
Fumana iipateni zesihluzi ezingaqhelekanga, imizamo engaphumelelanga, okanye izakhiwo zemibuzo engalindelekanga. USemperis ucebisa ukuba kujongwe i-Active Directory ukuze kujongwe imibuzo ye-LDAP engaqhelekanga okanye ukuguqulwa kwemetadata.
Itheyibhile yesishwankathelo sesichazi-magama #
| term | meaning |
|---|---|
| Inaliti ye-LDAP | Indlela yokufaka ikhowudi esebenzisa igalelo lomsebenzisi elingacocekanga kwiifilitha ze-LDAP. |
| Yintoni i-LDAP Injection | Ubuthathaka obuvela ekwakheni imibuzo ye-LDAP ngegalelo elingathembekanga. |
| Uhlaselo lwe-LDAP Injection | Ukuxhatshazwa okwenyani apho igalelo litshintsha i-logic yombuzo we-LDAP okanye lifumana ukufikelela. |
| Ubungozi bokujova nge-LDAP | Impazamo yenqanaba lekhowudi ivumela ukuhlaselwa kwe-LDAP ngenaliti. |
Kutheni Oku Kubalulekile kwiDevSecOps? #
kuba Amaqela eDevSecOps, ukuthintela ukuba sesichengeni kwe-LDAP kubalulekile ekuqinisekiseni ukuhamba kokuqinisekiswa kunye nolawulo lokufikelela oluxhaswa yi-directory. pipelinekufuneka zibandakanye ukujonga ikhowudi engashukumiyo yokwakhiwa kwemibuzo engakhuselekanga kunye novavanyo olutshintshatshintshayo lokuguqulwa kwesihluzi. Abaphathi bokhuseleko kufuneka baqinisekise ukusetyenziswa kweelayibrari ezibalekayo, ukusetyenziswa kwe-API emiselweyo, kunye nokunamathela kwimigaqo-nkqubo yokuqinisekisa ilungelo elincinci kunye nokufakwa kwesicelo.
Ukuqinisa i-DevSecOps Pipelines kunye neXygeni #
Ngoku ekubeni usazi ukuba yintoni i-LDAP injection, uyazi ukuba ukukhusela usetyenziso lwanamhlanje kuzo kufuna okungaphezulu kokulungiswa kwinqanaba lekhowudi. Amaqela eDevSecOps kufuneka aqinisekise ukhuseleko kulo lonke isoftware yokuphucula isoftware, ukusuka kwikhowudi ukuya ekwakheni ukuya ekusetyenzisweni.
Izixhobo ezifana I-Xygeni ukunika amandla amaqela ukuba abone iingozi zokujova kwangethuba ngokuhlanganisa uhlalutyo olungaguqukiyo, IaC ukuskena, kunye nokuqinisekisa ukunyanzeliswa komgaqo-nkqubo ngqo CI/CD imisebenzi. Ngokuhlala ujonga ukwakhiwa kwemibuzo engakhuselekanga, iingozi zokuxhomekeka, okanye ukulungelelaniswa okungafanelekanga, i-Xygeni inceda ukuthintela ukuhlaselwa kwe-LDAP ngaphambi kokuba ifikelele kwimveliso.
Ukudibanisa amaqonga afana neXygeni kulungelelanisa ukhuseleko kunye nesantya sophuhliso, kubonelela ngokubonakala ngexesha langempela, ulawulo oluzenzekelayo, kunye nesikhokelo sokulungisa esilungiselelwe ubunjineli obukhuselekileyo ngoyilo.
