Malicious deserialization from LDAP entry

[h3xstream]

When loading LDAP entry, enabling the automatic deserialisation is a risky behavior,

new SearchControls(originalControls.getSearchScope(),
                originalControls.getCountLimit(), originalControls.getTimeLimit(),
                originalControls.getReturningAttributes(), 
                true, //<--
                originalControls.getDerefLinkFlag());

If the LDAP address can be change or if some entries can be poison by an attacker, RCE could be trigger from the deserialization.

https://github.com/spring-projects/spring-security/blob/ce20cfcb9803a6175f6befc9008cadcc4e3b6d72/ldap/src/main/java/org/springframework/security/ldap/SpringSecurityLdapTemplate.java#L380

White paper from Black Hat USA 2016: https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE-wp.pdf (Page 29)

---

Also add the RCE risk to LDAP injection detector.

http://find-sec-bugs.github.io/bugs.htm#LDAP_INJECTION

[h3xstream]

Also look for searchControls.setReturningObjFlag(true)