> For the complete documentation index, see [llms.txt](https://icybersec.gitbook.io/cybersecuritynote-en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://icybersec.gitbook.io/cybersecuritynote-en/security-vulnerability/unauthorized-vulnerability/unauthorized-access-vulnerability-in-ldap.md).

# Unauthorized Access Vulnerability in LDAP

## Introduction

LDAP stands for Lightweight Directory Access Protocol, based on the X.500 standard and supports TCP/IP.

LDAP directory is a database and the LDAP server (equivalent to DBMS) handles queries and updates. Data is stored in a tree-like hierarchical structure and is optimized for reading performance compared to relational databases. LDAP is suitable for information with fewer changes and cross-platform.

**LDAP Attributes**

|  Attribute  |      Full Name     |                                                                 Description                                                                |
| :---------: | :----------------: | :----------------------------------------------------------------------------------------------------------------------------------------: |
|      dn     | distinguished name | A unique identifier, similar to an absolute path. Each object has a unique identifier. For example: uid=tester,ou=People,dc=example,dc=com |
|     rdn     |      relative      |                                 A relative identifier, similar to a relative path. For example: uid=tester                                 |
|     uid     |       user id      |                                       Usually refers to the user login name. For example: uid=tester                                       |
|      sn     |      sur name      |                                         Usually refers to a person's last name. For example: sn: Su                                        |
|   giveName  |                    |                                   Usually refers to a person's first name. For example: giveName: Aldwin                                   |
|      I      |                    |                                       Usually refers to the name of a place. For example: I: Beijing                                       |
| objectClass |                    |                   objectClass is a special attribute that contains the storage method and related attribute information.                   |
|      dc     |  domain component  |                                       Usually refers to a domain name. For example: dc=example,dc=com                                      |
|      ou     |  organization unit |                       Usually refers to the name of an organizational unit. For example: ou=people,dc=example,dc=com                       |
|      cn     |     common name    |                              Usually refers to an object's name. If it's a person, the full name is required.                              |
|      c      |       country      |                                        A two-letter country code. For example: CN, US, HK, JP, etc.                                        |

## Environment Setup

```
docker run -p 389:389 -p 636:636 --name my-openldap-container --detach osixia/openldap:1.5.0
```

## Vulnerability Reproduction

```
docker exec my-openldap-container ldapsearch -x -H ldap://localhost -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w admin
```

![image-20230130131836741](https://3024627155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXR7Pin8lqeHtCxmQjCpG%2Fuploads%2Fgit-blob-7054f999756532203dd5eba2b736d0afca2f6fcc%2Fimage-20230130131836741.png?alt=media)