LDAP directory accessed with an anonymous / credential-less bind

ID

vbnet.access_control.anonymous_ldap_bind

Severity

critical

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

low

Resource

Access Control

Language

VB.NET

Description

An LDAP directory is bound anonymously or with empty/null credentials (AuthenticationTypes.Anonymous, AuthType.Anonymous, or a DirectoryEntry created with empty/Nothing username and password). Anonymous binds expose directory data to unauthenticated access and let an attacker enumerate or modify entries the process should not reach. Bind with a dedicated service account over LDAPS and require authentication (e.g. AuthenticationTypes.Secure).

Rationale

An LDAP directory is bound anonymously or with empty/null credentials (AuthenticationTypes.Anonymous, AuthType.Anonymous, or a DirectoryEntry created with empty/Nothing username and password). Anonymous binds expose directory data to unauthenticated access and let an attacker enumerate or modify entries the process should not reach. Bind with a dedicated service account over LDAPS and require authentication (e.g. AuthenticationTypes.Secure).

The following code illustrates a vulnerable pattern detected by this rule:

Public Function AnonymousViaAuthType() As DirectoryEntry
    Dim entry As New DirectoryEntry("LDAP://server/DC=example,DC=com")
    ' VULNERABLE: LDAP directory accessed with an anonymous / credential-less bind
    entry.AuthenticationType = AuthenticationTypes.Anonymous
    Return entry
End Function

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References