LDAP Injection
LDAP Injection occurs when user input is incorporated into LDAP queries without proper sanitization. Attackers can modify the LDAP statement to access unauthorized data, bypass authentication, or enumerate directory information.
Overview
LDAP (Lightweight Directory Access Protocol) is widely used for authentication and directory lookups in enterprise environments. When applications build LDAP queries using unsanitized user input, attackers can inject special characters and LDAP filter operators to alter query behavior, bypass authentication, or extract sensitive directory information.
Types & Variants
Authentication Bypass
Injecting LDAP filter operators to bypass login mechanisms.
Information Disclosure
Modifying LDAP search filters to extract directory entries and attributes.
Impact
Authentication bypass, unauthorized directory access, user enumeration, privilege escalation within LDAP-integrated systems.
Examples
Login Bypass
(&(uid=*)(userPassword=*))
Remediation
Escape special LDAP characters in user input, use parameterized LDAP queries, implement strict input validation, and apply the principle of least privilege to LDAP service accounts.
Escape all LDAP special characters (*, (, ), \, NUL)
Use parameterized LDAP queries where available
Validate input against strict allowlists
Use read-only LDAP service accounts
Related SuperClue scanner checks
These scanner checks look for signs of LDAP Injection. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works