CWE-90 LDAP Injection

Coverage: 15 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 15 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged an LDAP query (filter / DN / search base) that is being constructed using untrusted input. LDAP has its own "query language" rules, string concatenation can let attackers change the meaning of the search.

Why it matters

LDAP injection can bypass auth or exfiltrate directory data.

• Auth bypass: attackers can turn a "match this user" filter into "match anyone".
• Directory enumeration: read attributes/groups you didn't intend to expose.
• Privilege escalation: if group membership checks rely on injectable filters.

Safer examples

1) Escape user-controlled values for LDAP filters (Python)

from ldap3.utils.conv import escape_filter_chars

username = escape_filter_chars(user_input)
ldap_filter = f"(uid={username})"

2) Don't build complex filters from user input

If users are selecting a field/search mode, allowlist it (e.g., only uid or mail) and keep the value escaped.

3) Restrict what can be searched and returned

• Use a dedicated service account with least privilege.
• Limit searchable bases and returned attributes.

How SiteShadow detects it (high level)

• Detects LDAP query/filter construction and tracks whether parts come from request/user-controlled values.
• Flags cases where escaping/allowlisting is missing, especially near auth/group checks.

References

• CWE-90: https://cwe.mitre.org/data/definitions/90.html

---

← Back to Vulnerability Library