the-web-application-hackers-handbook

352 Chapter 9 n Attacking Data Stores
Conjunctive Queries
Consider a similar application function that allows users to search for employees
by name, again within the geographic region they are authorized to view.
If a user is authorized to search within the London location, and he searches
for the name daf, the following query is performed:
(&(givenName=daf)(department=London*))
Here, the user’s input is inserted into a conjunctive query, the second part of
which enforces the required access control by matching items in only one of
the London departments.
In this situation, two different attacks might succeed, depending on the
details of the back-end LDAP service. Some LDAP implementations, including
OpenLDAP, allow multiple search filters to be batched, and these are applied
disjunctively. (In other words, directory entries are returned that match any of
the batched filters.) For example, an attacker could supply the following input:
*))(&(givenName=daf
When this input is embedded into the original search filter, it becomes:
(&(givenName=*))(&(givenName=daf)(department=London*))
This now contains two search filters, the first of which contains a single
wildcard match condition. The details of all employees are returned from all
locations, thereby subverting the application’s access control.
TRY IT!
http://mdsec.net/employees/42/
NOTE This technique of injecting a second search filter is also effective
against simple match conditions that do not employ any logical operator, provided
that the back-end implementation accepts multiple search filters.
The second type of attack against conjunctive queries exploits how many LDAP
implementations handle NULL bytes. Because these implementations typically are
written in native code, a NULL byte within a search filter effectively terminates the
string, and any characters coming after the NULL are ignored. Although LDAP
does not itself support comments (in the way that the -- sequence can be used
in SQL), this handling of NULL bytes can effectively be exploited to “comment
out” the remainder of the query.