CME-1318
LDAP Injection Prevention
Description
Prevention of LDAP injection attacks through parameterized LDAP queries, input sanitization of special characters (*, (, ), \, NUL, |, &), and use of LDAP filter escaping functions. Prevents attackers from manipulating LDAP search filters to bypass authentication, escalate privileges, or extract unauthorized directory data. Applies DN escaping for distinguished names and filter escaping for search filter values.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Requires crafted input AND LDAP filter bypass; escaping prevents filter manipulation |
| Integrity (I) | H → L | Prevents unauthorized directory writes and authentication bypass via filter injection |
| Confidentiality (C) | H → L | Prevents directory enumeration and unauthorized data extraction via wildcard injection |
CWE Relationships
Verification
Code review for LDAP filter escaping and parameterized queries
$ grep -r 'ldap_search' /path/to/app | grep -v -E '(ldap_escape|escapeLdapFilter|Filter.escape)'
# Expected: No matches (all queries use escaping)
# Expected: No matches (all queries use escaping)
Platform: linux
$ grep -r 'DirectorySearcher' /path/to/app/*.cs | grep 'Filter\s*=' | grep -v 'Encoder.LdapFilterEncode'
# Expected: No matches (all .NET LDAP queries use encoding)
# Expected: No matches (all .NET LDAP queries use encoding)
Platform: windows
$ semgrep --config 'r/generic.secrets.security.detected-ldap-injection' /path/to/app
# Expected: No findings
# Expected: No findings
Platform: any