Java


JAVA.INSEC.LDAP.ANON : Anonymous LDAP Authentication (Java)

Summary

LDAP authentication is set to anonymous, thus compromising security.

This checker identifies security issues related to authentication procedures, such as using no password for LDAP authentication or using the host name in conditions.

Properties

Class Name Anonymous LDAP Authentication (Java)
Significance security
Mnemonic JAVA.INSEC.LDAP.ANON
Categories
CWE CWE:1390 Weak Authentication
OWASP-2017 OWASP-2017:A2 Broken authentication
OWASP-2021 OWASP-2021:A7 Identification and authorization failures
Availability Available for Java only.
Enabling Checks for this warning class are enabled by default. To disable them, add the following WARNING_FILTER rule to the project configuration file.
WARNING_FILTER += discard class="Anonymous LDAP Authentication (Java)"

Example

The following code is taken from Sun Microsystem's None.java example.

import javax.naming.*;
import javax.naming.directory.*;

import java.util.Hashtable;

public class None {

  @SuppressWarnings({ "rawtypes", "unchecked" })
  public static void main(String[] args) {
    // Set up environment for creating initial context
    Hashtable env = new Hashtable(11);
    env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
    env.put(Context.PROVIDER_URL, "ldap://localhost:389/o=JNDITutorial");

    // Use anonymous authentication
    env.put(Context.SECURITY_AUTHENTICATION, "none"); // "Anonymous LDAP Authentication (Java)" warning issued here

    try {
      // Create initial context
      DirContext ctx = new InitialDirContext(env);

      System.out.println(ctx.lookup("ou=NewHires"));

      // do something useful with ctx

      // Close the context when we're done
      ctx.close();
    } catch (NamingException e) {
      e.printStackTrace();
    }
  }
}

Resolution

Check if the warning actually corresponds to a real security issue related to authentication and, if that is the case, use a more secure authentication procedure.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.