Hello,
We found critical vulnerability, which wasn’t detected by SonarQube. The vulnerability is LDAP Injection, and our code is similiar to the one in example.
Vulnerable function:
public <T> T lookupByCn(String cn, String rootName, Class<T> aClass) throws Exception {
DirContext ldapContext = new InitialDirContext(LDAP_ENV);
try {
Long cnLong;
try {
cnLong = Long.parseLong(cn);
} catch (NumberFormatException e) {
throw new RuntimeException(e);
}
String query = "(&(objectClass=*)(cn=" + cn + "))";
SearchControls ctrls = new SearchControls();
ctrls.setSearchScope(SearchControls.SUBTREE_SCOPE);
final NamingEnumeration<SearchResult> results = ldapContext.search(rootName, query, ctrls);
if (results.hasMore()) {
SearchResult r = results.nextElement();
Attributes attrs = r.getAttributes();
NamingEnumeration<? extends Attribute> namingEnum = attrs.getAll();
T returnValue = aClass.getDeclaredConstructor().newInstance();
while (namingEnum.hasMore()) {
Attribute attr = namingEnum.nextElement();
String id = attr.getID();
NamingEnumeration<?> newVal = attr.getAll();
changeValueInObject(returnValue, id, newVal);
}
return returnValue;
}
return null;
} finally {
ldapContext.close();
}
}
Let me know, what can we do to detect this kind of vulnerabilities in future.
- which versions are you using - SonarQube Enterprise EditionVersion 9.5 (build 56709)
- what are you trying to achieve - detecing vulnerability
- what have you tried so far to achieve this - we checked that the plugin was enabled in profile scan
have a nice day!