# Possible Net::LDAP Vulnerability

**URL:** <https://www.ruby-forum.com/t/possible-net-ldap-vulnerability/112547>\
**Category:** Rails\
**Created:** [August 20, 2007, 8:10pm UTC](https://www.ruby-forum.com/t/possible-net-ldap-vulnerability/112547 "2007-08-20T20:10:48Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![supasta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ebca7d/32.png) [@supasta](https://www.ruby-forum.com/u/supasta)\
**Post date:** [August 20, 2007, 8:10pm UTC](https://www.ruby-forum.com/t/possible-net-ldap-vulnerability/112547/1 "2007-08-20T20:10:48Z")

</div>

Note: this may not be a Net::LDAP vulnerability, but it may be a  
general usage vulnerability for authenticating against ADS.

Using Net::LDAP to authenticate users in a Rails application against  
Active Directory will allow valid usernames and blank passwords to  
authenticate as the username.

With the following method in the user class:

1 def User.ads\_login(params)  
2 ldap = Net::LDAP.new  
3  
4 ldap.host = “[dc.example.com](http://dc.example.com)”  
5 ldap.port = 389  
6  
7 ldap.auth “#{params[:username]}@example.com”, params[:password]  
8  
9 if ldap.bind  
10 #{ do something with ldap here }  
11 end  
12 end

If params[:username] = “validusername” and params[:password].blank? the  
above “ldap.bind” on line 9 will return true.

I don’t know the AD configuration, but I do know that it is repeatable  
inside of Rails 1.2.3 with Net::LDAP 0.0.4 and my ADS environment.

Chris