LDAP injection
Untrusted input changes the meaning of an LDAP search filter or distinguished name (CWE-90), letting an attacker bypass a login check or read other directory entries. Escape filter values as RFC 4515 requires and DN values as RFC 4514 requires, or build filters with a library.
- Fix it in your stack
- LDAP filter injection fix cards (2 stacks) · CWE-90 page
- Defined in
- MITRE CWE-90 · RFC 4515 · RFC 4514
- Identifiers
- CWE-90: LDAP injection
Covered in
Prevent NoSQL, LDAP, XPath and expression-language injection
SQL is not the only query language that receives user input. Stop MongoDB operator injection with type checks and $eq, escape LDAP filter values, pass XPath values as variables, and never evaluate SpEL or OGNL built from request data.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Practice: SQL injection lab: Separate SQL structure from data with sqlite3 · OS command injection lab: Run git without a shell · SSTI lab: Render a welcome banner without template injection · XXE lab: Parse an uploaded invoice without resolving external entities