LDAP Injection occurs when an application constructs LDAP queries using unsanitized user input, allowing an attacker to alter the query logic and bypass…
LDAP Injection occurs when an application constructs LDAP queries using unsanitized user input, allowing an attacker to alter the query logic and bypass authentication, extract unauthorized data, or modify directory information. Like SQL injection, it exploits the failure to distinguish between query structure and data, but targets LDAP directory services instead of databases.
LDAP (Lightweight Directory Protocol) queries use a filter syntax with special characters—such as *, (, ), &, |, and !—that carry meaning in the query language. When an application concatenates user input directly into an LDAP filter without escaping or parameterizing it, an attacker can inject these metacharacters to change the query's logic. For example, a login filter intended to match a specific username can be modified to match any user, or a search filter can be expanded to return unintended records. The vulnerability arises from treating user input as literal data when it is actually parsed as part of the query syntax.
Successful LDAP injection can lead to authentication bypass (logging in without valid credentials), unauthorized disclosure of directory information (usernames, email addresses, phone numbers), account enumeration, and in some cases modification or deletion of directory entries. Organizations using LDAP for centralized authentication—common in enterprise environments—face the risk of widespread account compromise if the vulnerability exists in a critical application.
import ldap
username = request.args.get('user')
password = request.args.get('pass')
# Directly concatenating user input into LDAP filter
ldap_filter = f"(&(uid={username})(userPassword={password}))"
conn = ldap.initialize("ldap://ldap.example.com")
try:
result = conn.search_s("dc=example,dc=com", ldap.SCOPE_SUBTREE, ldap_filter)
if result:
print("Login successful")
except ldap.INVALID_SYNTAX_ERR:
print("Login failed")Why it's vulnerable:
User input is concatenated directly into the LDAP filter string. An attacker can inject characters like * or )( to alter the query logic—for example, entering * as the username makes the filter match any user.
import ldap
from ldap.filter import escape_filter_chars
username = request.args.get('user')
password = request.args.get('pass')
# Escape special characters in user input
safe_username = escape_filter_chars(username)
safe_password = escape_filter_chars(password)
ldap_filter = f"(&(uid={safe_username})(userPassword={safe_password}))"
conn = ldap.initialize("ldap://ldap.example.com")
try:
result = conn.search_s("dc=example,dc=com", ldap.SCOPE_SUBTREE, ldap_filter)
if result:
print("Login successful")
except ldap.INVALID_SYNTAX_ERR:
print("Login failed")<?php
$username = $_POST['user'];
$password = $_POST['pass'];
// Directly concatenating user input into LDAP filter
$ldap_filter = "(&(uid=$username)(userPassword=$password))";
$ldap_conn = ldap_connect("ldap://ldap.example.com");
$result = ldap_search($ldap_conn, "dc=example,dc=com", $ldap_filter);
if (ldap_count_entries($ldap_conn, $result) > 0) {
echo "Login successful";
}
?>Why it's vulnerable:
User input from $_POST is inserted directly into the LDAP filter without escaping. Special LDAP characters in the input will be interpreted as query operators rather than literal data.
<?php
$username = $_POST['user'];
$password = $_POST['pass'];
// Escape special characters for LDAP
$safe_username = ldap_escape($username, null, LDAP_ESCAPE_FILTER);
$safe_password = ldap_escape($password, null, LDAP_ESCAPE_FILTER);
$ldap_filter = "(&(uid=$safe_username)(userPassword=$safe_password))";
$ldap_conn = ldap_connect("ldap://ldap.example.com");
$result = ldap_search($ldap_conn, "dc=example,dc=com", $ldap_filter);
if (ldap_count_entries($ldap_conn, $result) > 0) {
echo "Login successful";
}
?>ldap_escape() in PHP, escape_filter_chars() in Python's ldap library).
*, (, ), &, |, !) to verify escaping is working.
Check your application logs for LDAP errors or unexpected query patterns, particularly INVALID_SYNTAX_ERR exceptions or searches returning unusually large result sets. Review authentication logs for successful logins with suspicious usernames (e.g., containing * or parentheses), or unexpected directory entries being accessed or modified. If your application uses LDAP for authentication or directory lookups and user input is concatenated into filter strings without escaping, you are at risk.
