Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Description

This vulnerability occurs when an application builds an LDAP query using untrusted user input without properly sanitizing it. An attacker can inject special characters or commands to alter the query's logic, potentially gaining unauthorized access to, modifying, or extracting sensitive directory information.

Extended Description

LDAP Injection happens much like SQL injection, but targets Lightweight Directory Access Protocol queries. When user input from a form, URL parameter, or API request is directly concatenated into an LDAP search filter (like `(cn=` + userInput + `)`), an attacker can insert characters like `*`, `(`, `)`, `\`, or `null` to break the query's structure. This allows them to bypass authentication, escalate privileges, or dump the entire contents of the directory by creating filters like `*)(uid=*))(|(uid=*` that always return results. To prevent this, developers should never construct LDAP filters by simple string concatenation. Instead, use parameterized queries or the encoding functions provided by your LDAP library (like `escapeLDAPSearchFilter` in Java or `ldap_escape` in PHP) to properly neutralize special characters. Always apply the principle of least privilege to the LDAP binding account and validate all input against a strict allow-list of expected characters before it reaches the query builder.

Common Consequences 1

Scope: ConfidentialityIntegrityAvailability

Impact: Execute Unauthorized Code or CommandsRead Application DataModify Application Data

An attacker could include input that changes the LDAP query which allows unintended commands or code to be executed, allows sensitive data to be read or modified or causes other unintended behavior.

Detection Methods 1

Automated Static AnalysisHigh

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Potential Mitigations 1

Phase: Implementation

Strategy: Input Validation

Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

Demonstrative Examples 1

ID : DX-210

The code below constructs an LDAP query using user input address data:

Code Example:Bad
Java
java

Because the code fails to neutralize the address string used to construct the query, an attacker can supply an address that includes additional LDAP queries.

Observed Examples 2

CVE-2021-41232Chain: authentication routine in Go-based agile development product does not escape user name (Improper Encoding or Escaping of Output), allowing LDAP injection (Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'))

CVE-2005-2301Server does not properly escape LDAP queries, which allows remote attackers to cause a DoS and possibly conduct an LDAP injection attack.

References 1

Web Applications and LDAP Injection

SPI Dynamics

ID: REF-879

Applicable Platforms

Languages:

Not Language-Specific : Undetermined

Technologies:

Database Server : Undetermined

Modes of Introduction

Implementation

Related Attack Patterns

136
Type Errors

Related Weaknesses

ChildOf:

Improper Neutralization of Special Elements in Data Query Logic (CWE-943)

Taxonomy Mapping

PLOVER
OWASP Top Ten 2007
WASC
Software Fault Patterns

Notes

RelationshipFactors: resultant to special character mismanagement, MAID, or denylist/allowlist problems. Can be primary to authentication and verification errors.