LDAP Injection

Description

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'). All inputs passed to an LDAP query need to be passed in safely. Unfortunately, LDAP doesn't have prepared statement interfaces like SQL. Therefore, the primary defense against LDAP injection is strong input validation of any untrusted data before including it in an LDAP query.

Examples

Insecure Code

def search(ctx: javax.naming.directory.DirContext, input: String): Unit = {
  ctx.search("", input, new SearchControls())
}

Secure Code

def search(ctx: javax.naming.directory.DirContext, input: String): Unit = {
  val safeInput = input.replace("(*","").replace(")","")
  ctx.search("", safeInput, new SearchControls())
}

Remediation

Validate all untrusted input data before including it in an LDAP query.

Rule Details

Field	Value
ID	CODE-0048
Category	Injection
Severity	MEDIUM
CWE	CWE-90
Confidence	HIGH
Impact	MEDIUM
Likelihood	MEDIUM
Exploitability	MODERATE
Tags	ldap, injection
OWASP	N/A

---