[JAMES-2243] Encode special characters in LDAP search filter to prevent injections

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: master
• Component/s: data, ldap
• Labels: security
• Assignee: Unassigned
• Reporter: Thibaut SAUTEREAU
• Created: 29/Nov/17 10:16
• Updated: 30/Nov/17 16:30
• Resolved: 30/Nov/17 16:30

Description

The user-controlled "name" input is not sanitized when making LDAP searches with searchAndBuildUser. This could lead to LDAP injections using special characters.

Possible scenario: an attacker can bruteforce password authentication without needing to target a specific user of test every user. For instance, instead of needing to test 1 M passwords on [e-mail] and then on [e-mail], he can test on a*. Then if a password matches, he can quickly get to the user by dichotomy (aa*, ab*, aba*, abb*, etc.).