CME-1318

LDAP Injection Prevention

Description

Prevention of LDAP injection attacks through parameterized LDAP queries, input sanitization of special characters (*, (, ), \, NUL, |, &), and use of LDAP filter escaping functions. Prevents attackers from manipulating LDAP search filters to bypass authentication, escalate privileges, or extract unauthorized directory data. Applies DN escaping for distinguished names and filter escaping for search filter values.

CVSS Vector Impacts

Metric Transition Rationale
Attack Complexity (AC) L H Requires crafted input AND LDAP filter bypass; escaping prevents filter manipulation
Integrity (I) H L Prevents unauthorized directory writes and authentication bypass via filter injection
Confidentiality (C) H L Prevents directory enumeration and unauthorized data extraction via wildcard injection

CWE Relationships

Verification

Code review for LDAP filter escaping and parameterized queries

$ grep -r 'ldap_search' /path/to/app | grep -v -E '(ldap_escape|escapeLdapFilter|Filter.escape)'
# Expected: No matches (all queries use escaping)
Platform: linux
$ grep -r 'DirectorySearcher' /path/to/app/*.cs | grep 'Filter\s*=' | grep -v 'Encoder.LdapFilterEncode'
# Expected: No matches (all .NET LDAP queries use encoding)
Platform: windows
$ semgrep --config 'r/generic.secrets.security.detected-ldap-injection' /path/to/app
# Expected: No findings
Platform: any

References

← CME-1317: XML External Entity Prevention (Secure XML Parser Configuration) CME-1319: Deserialization Type Allowlisting →