Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query.
If user input is incorporated into an LDAP query without proper sanitization, an attacker can inject LDAP commands that could read or modify sensitive directory information.
How to fix this vulnerability
Prevention strategies for LDAP Injection based on 3 Shoulder detection rules.
Use ldap.EscapeFilter to sanitize user input in LDAP queries
package main import ( "fmt" "net/http" "github.com/go-ldap/ldap/v3" ) func handler(w http.ResponseWriter, r *http.Request) { username := r.FormValue("username") - // Vulnerable: user input in LDAP filter - filter := fmt.Sprintf("(&(uid=%s)(objectClass=person))", username) + // Safe: escape special LDAP filter characters + escaped := ldap.EscapeFilter(username) + filter := fmt.Sprintf("(&(uid=%s)(objectClass=person))", escaped) searchRequest := ldap.NewSearchRequest( "dc=example,dc=com", ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false, filter, []string{"dn", "cn"}, nil, ) result, _ := conn.Search(searchRequest) }
Escape LDAP special characters in user input before constructing LDAP queries
const express = require('express'); const ldap = require('ldapjs'); const app = express(); - app.post('/login', (req, res) => { - const username = req.body.username; + function escapeLDAP(str) { + return str.replace(/[\\*()\\x00]/g, c => + '\\' + c.charCodeAt(0).toString(16).padStart(2, '0')); + } + + app.post('/login', (req, res) => { + const username = escapeLDAP(req.body.username); const filter = `(&(uid=${username})(objectClass=person))`; client.search('dc=example,dc=com', { filter }, (err, result) => { res.json(result); }); });
Escape LDAP special characters using escape_filter_chars() before constructing filters
import ldap - from flask import request - - @app.route('/search') - def search(): - username = request.args.get('username') - conn = ldap.initialize('ldap://localhost') - filter_str = f"(uid={username})" + from ldap.filter import escape_filter_chars + from flask import request + + @app.route('/search') + def search(): + username = request.args.get('username', '') + safe_username = escape_filter_chars(username) + conn = ldap.initialize('ldap://localhost') + filter_str = f"(uid={safe_username})" results = conn.search_s('dc=example,dc=com', ldap.SCOPE_SUBTREE, filter_str) return str(results)
Find vulnerabilities in your code
Use Shoulder to scan your codebase for Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') patterns. 3 rules.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=90 # Or scan entire project npx @shoulderdev/cli trust .
Detection Rules (3)
What to watch for in code reviews
These patterns indicate potential Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerabilities. Look for these during code reviews and security audits.
Scan your codebase for Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Shoulder CLI finds vulnerable patterns across your entire codebase.