CME-1318
LDAP Injection Prevention
Description
Prevention of LDAP injection attacks through parameterized LDAP queries, input sanitization of special characters (*, (, ), \, NUL, |, &), and use of LDAP filter escaping functions. Prevents attackers from manipulating LDAP search filters to bypass authentication, escalate privileges, or extract unauthorized directory data. Applies DN escaping for distinguished names and filter escaping for search filter values.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Requires crafted input AND LDAP filter bypass; escaping prevents filter manipulation |
| Integrity (I) | H → L | Prevents unauthorized directory writes and authentication bypass via filter injection |
| Confidentiality (C) | H → L | Prevents directory enumeration and unauthorized data extraction via wildcard injection |
CWE Relationships
Verification
Code review for LDAP filter escaping and parameterized queries
$ grep -rn 'ldap_escape\|escapeLdapFilter\|Filter\.escape\|LdapFilterEncode\|escape_filter_chars\|ldap_escape_filter' <app_source>/
# Expected: LDAP filter escaping functions present in code paths that construct LDAP queries
# Expected: LDAP filter escaping functions present in code paths that construct LDAP queries
Platform: any
$ grep -rn 'ldap_search\|search_s\|ldap\.search\|DirectorySearcher\|LdapConnection.*Search\|SearchRequest' <app_source>/ | grep -v -i 'escape\|encode\|sanitiz\|filter_format' | head -10
# Expected: Zero matches — all LDAP search calls should have upstream escaping or parameterization
# Expected: Zero matches — all LDAP search calls should have upstream escaping or parameterization
Platform: any
$ grep -rn 'dn_escape\|escape_dn_chars\|escapeDN\|Encoder.LdapDistinguishedNameEncode' <app_source>/
# Expected: DN escaping present for code paths that construct distinguished names from user input
# Expected: DN escaping present for code paths that construct distinguished names from user input
Platform: any