php.lang.security.ldap-bind-without-password.ldap-bind-without-password

profile photo of semgrepsemgrep
Author
unknown
Download Count*
LGPL Commons Clause
License

Detected anonymous LDAP bind. This permits anonymous users to execute LDAP statements. Consider enforcing authentication for LDAP.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: ldap-bind-without-password
    patterns:
      - pattern-either:
          - pattern: ldap_bind($LDAP, $DN, NULL)
          - pattern: ldap_bind($LDAP, $DN, '')
          - patterns:
              - pattern: ldap_bind(...)
              - pattern-not: ldap_bind($LDAP, $DN, $PASSWORD)
    message: Detected anonymous LDAP bind. This permits anonymous users to execute
      LDAP statements. Consider enforcing authentication for LDAP.
    metadata:
      references:
        - https://www.php.net/manual/en/function.ldap-bind.php
      cwe:
        - "CWE-287: Improper Authentication"
      owasp:
        - A02:2017 - Broken Authentication
        - A07:2021 - Identification and Authentication Failures
      category: security
      technology:
        - php
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: LOW
      confidence: LOW
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Improper Authentication
    languages:
      - php
    severity: WARNING

Examples

ldap-bind-without-password.php

<?php

$ldapconn = ldap_connect("foo.com");

// ruleid: ldap-bind-without-password
$ldapbind = ldap_bind($ldapconn);

// ruleid: ldap-bind-without-password
LDAP_BIND($ldapconn, "username");

// ruleid: ldap-bind-without-password
ldap_bind($ldapconn, NULL, NULL);

// ruleid: ldap-bind-without-password
ldap_bind($ldapconn, "username", "");

$a = "";
$b = "";
// ruleid: ldap-bind-without-password
ldap_bind($ldapconn, $a, $b);

$c = "username";
$d = "";
// ruleid: ldap-bind-without-password
ldap_bind($ldapconn, $c, $d);

$e = "user";
$f = "pass";
// ok: ldap-bind-without-password
ldap_bind($ldapconn, $e, $f);

// ok: ldap-bind-without-password
ldap_bind($ldapconn, "username", "password");

// ok: ldap-bind-without-password
ldap_bind($ldapconn, $username, $password);