LDAP Injection

Also Known As

TL;DR

Explanation

LDAP injection is analogous to SQL injection but targets Lightweight Directory Access Protocol queries. If user-supplied values are concatenated directly into an LDAP filter string, an attacker can alter the query logic — for example, injecting *)(&) to match all entries or bypass authentication checks. PHP applications using ldap_search() must escape special characters with ldap_escape() before building filter strings.

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Concatenating user input into LDAP filter strings without using ldap_escape().
• Not specifying LDAP_ESCAPE_FILTER or LDAP_ESCAPE_DN context in ldap_escape() calls.
• Binding to LDAP with an admin account for all operations instead of a restricted read-only account.
• Believing that LDAP is only used for authentication and therefore less exploitable than SQL databases.

Code Examples

$filter = "(uid=$username)"; ldap_search($conn, $base, $filter);

$safe = ldap_escape($username, '', LDAP_ESCAPE_FILTER); ldap_search($conn, $base, "(uid=$safe)");

References

• ↗ https://owasp.org/www-community/attacks/LDAP_Injection
• ↗ https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html

Tags

Related Terms