LanDscAPe: Exploring LDAP Weaknesses and Data Leaks at Internet Scale

LanDscAPe: Exploring LDAP Weaknesses and Data Leaks at Internet Scale

Speakers: Jonas Kaspereit; Gurur Öndarö; Gustavo Luvizotto Cesar; Simon Ebbers; Fabian Ising; Christoph Saatjohann; Mattijs Jonker; Ralph Holz; Sebastian Schinzel

Conference: USENIX Security '24

YouTube: https://www.youtube.com/watch?v=Pv9jnMrZdro

Overview

This talk, presented by Jonas Kaspereit and a team of researchers from FH Münster and other institutions, unveils the findings of a groundbreaking, internet-wide study into the security posture of Lightweight Directory Access Protocol (LDAP) servers. Titled "LanDscAPe," the research highlights pervasive misconfigurations, insecure practices, and widespread data leaks affecting critical infrastructure globally. The presentation details the methodology behind scanning the entire IPv4 internet space for exposed LDAP services, meticulously analyzing their configurations, and identifying the extent of sensitive information, including personal data and plain-text credentials, made publicly accessible.

The significance of this research cannot be overstated. LDAP serves as a foundational protocol for directory services, enabling critical functions such as centralized authentication, single sign-on (SSO) solutions, role-based access control (RBAC), and corporate address books for countless organizations worldwide. Despite its ubiquitous and critical role, the talk reveals a stark reality: a substantial portion of internet-facing LDAP servers are dangerously misconfigured, creating vast attack surfaces and exposing millions of user credentials. The findings underscore a severe security blind spot that attackers can readily exploit, making this study an urgent call to action for defenders and system administrators.

The LanDscAPe project addresses a long-standing research gap, as no prior comprehensive studies had systematically assessed the security landscape of public LDAP servers at such a scale. By developing a novel scanning and analysis tool, the researchers have provided an unprecedented look into the vulnerabilities plaguing these essential services. Their ethical approach, including a disclosure campaign with national CERTs, further emphasizes the critical nature of their discoveries and the collective responsibility to secure these vital components of the global IT infrastructure.

Background

▶ Watch: Introduction: 'I might know your password' (0:00)

LDAP is a cornerstone protocol in modern IT environments, designed for accessing and maintaining distributed directory information services. Its initial design in the 1990s as a lightweight alternative to the X.500 Directory Access Protocol (DAP) quickly led to its widespread adoption. Today, LDAP directories are integral to enterprise networks, serving as the backbone for user authentication, authorization, and information retrieval. Common use cases include Active Directory in Microsoft environments, OpenLDAP for Unix-like systems, and various identity management solutions that leverage LDAP for centralized authentication, enabling single sign-on (SSO) across disparate applications and providing granular role-based access control (RBAC). For many organizations, an LDAP server acts as the authoritative source for user identities, group memberships, and even network resource configurations.

Despite its critical importance, the security implications of publicly exposed LDAP servers have not been thoroughly investigated at an internet-wide scale. While individual vulnerabilities in specific LDAP implementations or common misconfigurations are known within the security community, a comprehensive, statistical overview of the global LDAP threat landscape was conspicuously absent. This research gap meant that organizations often lacked a clear understanding of the broader risks associated with their LDAP deployments, particularly when exposed to the internet. The problem is exacerbated by the protocol's flexibility, which, if not configured with stringent security in mind, can easily lead to unintended information disclosure. The default configurations of some LDAP server software, combined with a lack of awareness or oversight from administrators, often result in directory services returning sensitive information in response to unauthenticated or poorly authenticated queries. This historical context of widespread usage without adequate global security scrutiny set the stage for the LanDscAPe project, which sought to quantify and qualify these risks by systematically scanning and analyzing internet-facing LDAP servers.

Key Findings

▶ Watch: Ethical measures to minimize harm and protect user data (3:00)

The LanDscAPe study unearthed a disturbing array of security deficiencies across internet-facing LDAP servers, revealing widespread misconfigurations and significant data exposure. The initial reconnaissance phase, involving a ZMap scan of the entire IPv4 space, identified approximately 3.7 million hosts responding on Port 389 for plain LDAP and a similar number on Port 636 for LDAP over TLS. From this vast pool, nearly 82,000 distinct IP addresses responded positively to LDAP bind requests, forming the basis for subsequent, deeper analysis.

A critical finding was the prevalence of misconfigured authentication and authorization mechanisms. A staggering 95% of all cases allowed the retrieval of the root DSE (Directory Service Entry) without any bind operation whatsoever. Even more concerning, for the remaining 5% where an initial unauthenticated request failed, information could still be retrieved via a bind with both username and password fields left empty, indicating fundamental flaws in how these servers enforce access controls.

The data classification module identified two primary categories of issues:

1. Sensitive Configurations:

• Insecure Authentication: One-fifth of the LDAP servers, nearly 26,000 hosts, supported "insecure" authentication mechanisms, such as certain SAML-like protocols, which research has already identified as problematic. A detailed list of these problematic mechanisms is included in the full paper.
• Internal Information Exposure: Over 9,000 hosts were found to be exposing internal information that should never be publicly accessible, including sensitive Microsoft Active Directory policies.
• Known Vulnerabilities: More than 600 servers were identified as running versions with known vulnerabilities, highlighting a severe patch management issue.

1. Personal Data and Credential Leaks:

• Personal Data Exposure: A significant 12,000 servers were publishing at least one piece of personal information. This included highly sensitive data such as names, email addresses, phone numbers, and even Social Security numbers.
• Credential Leaks: Perhaps the most alarming finding was the widespread exposure of credentials. Over 1,800 servers were found to be leaking credentials as of January 2024. Through a mixed manual and automatic analysis, the researchers determined that approximately 32% of these servers were leaking "plausible credentials," including a substantial number of plain text passwords. The study estimated that over 3.9 million credentials were publicly accessible in January 2024. A striking example cited was a university that exposed over 30,000 credentials, including email addresses and plain text passwords.
• Admin User Leaks: The research further identified 526 servers where at least one username containing the "admin" substring was found in combination with a leaked password, indicating potential compromise of highly privileged accounts.

Finally, the study scrutinized the TLS configurations of these LDAP servers. Only 36% of TLS-enabled servers supported the latest recommended TLS versions. More critically, 65% of servers used non-recommended TLS Cipher Suites according to RFC guidelines. The researchers observed a direct correlation between the use of weaker cryptography and the leakage of sensitive data, suggesting that organizations with lax security practices in one area often exhibit them in others.

The researchers undertook an ethical disclosure campaign in collaboration with national CERTs in February 2025. Out of the initial 1,817 servers identified as leaking passwords, subsequent probes revealed that 475 were no longer available, and 5 servers had implemented authentication requirements. While this indicates a positive impact, a substantial number of credential-leaking LDAP servers regrettably remained online, underscoring the ongoing challenge of securing these critical services.

Technical Deep Dive

▶ Watch: Identification of sensitive configurations and internal information leaks (7:00)

The LanDscAPe project was driven by a sophisticated, multi-stage pipeline designed to systematically identify, analyze, and classify the security posture of internet-facing LDAP servers. The core of this research involved the custom-built LanDscAPe tool, which orchestrated a comprehensive scanning, sampling, and data analysis process.

The research pipeline commenced with a scanning module, leveraging ZMap to conduct an exhaustive scan of the entire IPv4 internet space. This initial sweep targeted the standard LDAP ports: Port 389 for unencrypted LDAP communication and Port 636 for LDAPS (LDAP over TLS). This wide-net approach allowed the researchers to identify a significant footprint of potential LDAP hosts, filtering down to those that actively responded to basic LDAP bind requests. The volume of initial responses—millions of hosts on both ports—underscored the scale of LDAP's internet exposure.

Following the initial scan, the sampling module engaged in a meticulous, three-step process to interact with each identified LDAP server and gather configuration and metadata:

1. Initial Request without Bind: The tool first attempted to query the server without providing any authentication credentials. This step was crucial for identifying servers that, due to misconfiguration, would return information to completely unauthenticated requests.
2. Simple Bind with Empty Credentials: Next, the tool performed a simple bind request where both the username and password fields were deliberately left empty. This probed for servers configured to allow anonymous binds or those with default, empty credentials, indicative of severe misconfiguration.
3. Unauthenticated Bind with Arbitrary Username: Finally, an unauthenticated bind was attempted using an arbitrary username but still leaving the password field empty. This was designed to catch specific misconfigurations where a username might be required but any password (or lack thereof) would be accepted.

During these sampling interactions, LanDscAPe collected vital configuration information and metadata. This included the root DSE (Directory Service Entry), which provides details on supported controls, extensions, features, and LDAP versions. The tool also gathered the schema, naming contexts, and password policies if they were publicly available. Crucially, the researchers implemented a strict limit, requesting a maximum of 15 entries per server for any specific search query to minimize the impact on affected systems and adhere to ethical research guidelines.

The data classification module was responsible for evaluating the gathered data against predefined criteria to identify security issues. It categorized findings into sensitive configurations and personal data exposure:

• Sensitive Configurations: This involved identifying servers supporting known insecure authentication mechanisms (e.g., specific SAML mechanisms detailed in their paper), those exposing internal information like Microsoft Active Directory policies, and servers running versions with known vulnerabilities (CVEs). The presence of these indicators pointed to systemic security weaknesses.
• Personal Data and Credential Exposure: For personal data, the module looked for attributes commonly associated with personally identifiable information (PII) such as names, email addresses, phone numbers, and Social Security numbers. For credentials, the process was particularly sensitive. The researchers developed a unique counting method to quantify credential leaks without actually transferring or downloading the sensitive information itself. This ethical approach involved identifying attributes commonly used for passwords (e.g., userPassword, unicodePwd) and then classifying them as plain text or hashed based on their format, while ensuring the raw credential data remained on the target server. This method allowed them to report that over 3.9 million credentials were publicly accessible without directly acquiring them.

A dedicated analysis of TLS configurations was also performed. This involved assessing the versions of TLS supported by LDAPS servers and scrutinizing the cipher suites in use against RFC guidelines. The observation that 65% of servers utilized non-recommended cipher suites and that weaker cryptography often correlated with data leakage underscored the importance of a holistic approach to security, extending beyond just directory access controls to the transport layer.

Throughout the entire process, ethical measures were paramount. The researchers limited sample sizes, minimized data transfer, processed all collected metadata on a secured internal server with restricted access, and deleted classified data samples, retaining only anonymized metadata for their disclosure campaign. This commitment to ethical conduct ensured that the study provided critical security insights while minimizing potential harm to the operators of vulnerable systems.

Demo / Proof of Concept

▶ Watch: Critical finding: widespread personal data and plain text password leaks (8:00)

While the presentation did not feature a live, interactive demonstration of the LanDscAPe tool or a specific proof-of-concept exploit during the talk, the entire research project serves as a comprehensive proof of concept for internet-scale vulnerability scanning and data leakage identification in LDAP environments. The methodology outlined, particularly the three-step sampling process (unauthenticated, empty-credential bind, arbitrary username with empty password), effectively demonstrated how common misconfigurations could be leveraged to extract sensitive information.

The researchers' "unique counting method" for credentials, which allowed them to quantify millions of leaked passwords without actually transferring them, stands as a testament to their innovative and ethical approach to demonstrating the problem without exacerbating it. Furthermore, the detailed statistical findings, such as the university example where over 30,000 credentials, including plain text passwords and email addresses, were exposed, serve as compelling evidence of the real-world impact of these vulnerabilities. This concrete finding, derived from their systematic analysis, functions as a powerful, data-driven proof point for the scale and severity of the issues identified. The subsequent disclosure campaign and the observed reduction in some vulnerable servers further validate the effectiveness of their methodology in identifying and prompting remediation for these critical security flaws.

Defensive Implications

▶ Watch: Disclosure campaign to address identified vulnerabilities (10:39)

The findings of the LanDscAPe study present a stark warning and a clear call to action for organizations managing LDAP servers, especially those exposed to the internet. Defenders must prioritize securing these critical directory services to prevent widespread data breaches and potential compromise of their entire IT infrastructure.

1. Strict Access Control and Authentication: The most fundamental implication is the need to enforce robust authentication and authorization mechanisms. Organizations must immediately review their LDAP server configurations to ensure that unauthenticated binds are strictly prohibited. Furthermore, any allowance for binds with empty usernames or passwords, or arbitrary usernames with empty passwords, must be eliminated. Access to the root DSE, schema, and other configuration metadata should be restricted to authenticated, authorized administrators only.
2. Regular Configuration Audits: Given the prevalence of misconfigurations, regular and comprehensive audits of LDAP server configurations are essential. This includes checking for the exposure of internal information, such as Microsoft Active Directory policies, which should never be publicly accessible. Tools like LanDscAPe (or similar vulnerability scanners) should be employed internally to proactively identify and remediate such exposures.
3. Patch Management and Vulnerability Remediation: The discovery of over 600 servers with known vulnerabilities underscores the critical importance of a rigorous patch management strategy. Administrators must ensure their LDAP server software and underlying operating systems are kept up-to-date with the latest security patches to mitigate known CVEs.
4. Secure Authentication Mechanisms: The study highlighted the use of "insecure" authentication mechanisms by 26,000 servers. Organizations should review their chosen authentication protocols, especially those involving SAML-like mechanisms, and transition to stronger, industry-recommended standards. Multi-factor authentication (MFA) should be implemented wherever possible, even for LDAP-backed services.
5. Data Minimization and Attribute Control: Organizations should adopt the principle of least privilege for data exposure. Only attributes absolutely necessary for public-facing or application-specific queries should be exposed. Sensitive personal data (names, emails, phone numbers, SSNs) and, critically, passwords (even hashed ones) should never be retrievable via unauthenticated or weakly authenticated LDAP queries.
6. TLS Hardening: The pervasive issues with TLS configurations demand immediate attention. All LDAP traffic should be encrypted using LDAPS (Port 636), and plain LDAP (Port 389) should be disabled or restricted to trusted internal networks only. Furthermore, servers must be configured to use the latest TLS versions (e.g., TLS 1.2 or 1.3) and strong, recommended cipher suites as per current RFC guidelines, avoiding weaker cryptography that can correlate with data leakage.
7. Network Segmentation and Firewall Rules: LDAP servers, especially those containing sensitive data or acting as primary authentication sources, should not be directly exposed to the internet unless absolutely necessary. When internet exposure is unavoidable, strict firewall rules should be implemented to limit access to only trusted IP addresses or specific services (e.g., VPN gateways, application proxies). Network segmentation can further protect these assets by isolating them from less secure parts of the network.
8. Employee Training and Awareness: Administrators and developers responsible for deploying and configuring LDAP services must be educated on secure configuration practices, the potential risks of misconfiguration, and the importance of adhering to security best practices.

By implementing these defensive measures, organizations can significantly reduce their attack surface, protect sensitive user data, and prevent their LDAP infrastructure from becoming a gateway for malicious actors.

Key Takeaways

• Pervasive Exposure and Misconfiguration: The study revealed over 80,000 internet-facing LDAP servers, with widespread misconfigurations allowing unauthenticated or empty-credential access to critical information, including the root DSE.
• Massive Data Leaks: A staggering 12,000 servers exposed personal data, and over 1,800 servers (totaling 3.9 million credentials) were leaking plausible credentials, including plain text passwords and admin account details.
• Systemic Security Flaws: Beyond data leaks, thousands of servers were found supporting insecure authentication mechanisms, exposing internal Active Directory policies, and running with known vulnerabilities, indicating fundamental security hygiene issues.
• Weak TLS Correlates with Risk: A significant majority (65%) of TLS-enabled LDAP servers used non-recommended cipher suites, and this weaker cryptography was often correlated with the leakage of sensitive data, highlighting the need for comprehensive security at all layers.
• Urgent Call for Remediation: Despite disclosure efforts, a substantial number of vulnerable LDAP servers remain online, underscoring the urgent need for organizations to proactively audit, patch, and harden their LDAP infrastructure to prevent exploitation.

About the Speaker(s)

The LanDscAPe research was a collaborative effort led by Jonas Kaspereit from FH Münster, who presented the findings at USENIX Security '24. He was joined by a distinguished team of researchers including Gurur Öndarö, Gustavo Luvizotto Cesar, Simon Ebbers, Fabian Ising, Christoph Saatjohann, Mattijs Jonker, Ralph Holz, and Sebastian Schinzel. This collective brings expertise from various academic and research institutions, pooling their knowledge to conduct this comprehensive and impactful study on internet-scale LDAP security. Their work underscores a commitment to identifying and addressing critical security vulnerabilities that affect global IT infrastructure.