LDAP Injection Attack
LDAP Injection is a type of injection attack where an attacker manipulates LDAP (Lightweight Directory Access Protocol) queries by injecting malicious input into fields that are used to build LDAP filters.
It is similar in concept to SQL injection, but targets LDAP directory services such as:
- Active Directory
- OpenLDAP
- Oracle Internet Directory
- Novell eDirectory
LDAP is often used for:
- Authentication (“log in with your corporate account”)
- Authorization (retrieving user permissions)
- Directory lookups (searching for users, groups, devices)
When developers build LDAP queries using unsanitized user input, attackers can alter query logic and access unauthorized data, or bypass authentication entirely.
How LDAP Queries Work
A typical LDAP search filter looks like this:
(&(objectClass=person)(uid=jsmith))
This means:
- Find entries that are person objects
- With a uid of jsmith
When a login form accepts a username and password, the backend might form a query like:
(&(uid={username})(password={password}))
If user input is inserted directly, it becomes vulnerable.
How LDAP Injection Happens
Suppose a login form uses this filter:
(&(uid={USER})(userPassword={PASS}))
If an attacker enters:
- Username: *
- Password: *)(&(uid=*))
The resulting LDAP filter becomes:
(& (uid=*) (userPassword=*) )(&(uid=*) ))
This can cause:
- Always‑true conditions
- Bypassed authentication
- Disclosure of all directory entries
Common LDAP Injection Attack Techniques
1. Authentication Bypass
Attackers input special LDAP wildcard characters like:
*) (|
Example malicious input:
Username:
admin*)(|(uid=*))
Resulting filter:
(&(uid=admin*)(|(uid=*))(password=…))
This filter will return all users, potentially allowing authentication without knowing the password.
2. Data Extraction
Attackers alter search filters to reveal:
- Usernames
- Email addresses
- Group memberships
- Other directory attributes
Example injection:
*)(mail=*)
This changes the query to return every entry with an email address.
3. Privilege Escalation
If an LDAP-based app determines permissions by querying group membership, an attacker may alter the group filter to trick the application into thinking they belong to an admin group.
4. Denial of Service (DoS)
Injecting heavy filters like nested OR conditions can overload the directory server:
*)(|(uid=*)(cn=*))(foo=*
Why LDAP Injection Is Dangerous
LDAP injection attacks can allow attackers to:
- Bypass authentication
- Retrieve sensitive records (users, groups, credentials, metadata)
- Escalate privileges
- Modify directory entries (if the app allows write access)
- Compromise entire identity infrastructure (e.g., Active Directory)
Since directory services control authentication/authorization, LDAP injection is often more damaging than SQL injection.
How to Prevent LDAP Injection
1. Use Parameterized LDAP Queries
- Instead of concatenating strings, use safe parameterized APIs (varies by language).
2. Validate and Sanitize User Input
- Reject special LDAP filter characters:
- (, ), *, |, &, =
- Allow only expected characters in usernames, emails, etc.
3. Escape LDAP Special Characters
- Properly escape user input before using it in queries.
4. Enforce Least Privilege on LDAP Accounts
- Ensure the application binds to a user with read-only access and a limited scope.
5. Implement Strong Authentication Controls
- Multi-factor authentication reduces the impact of bypass attempts.
6. Use Application Firewalls
- WAFs/IDSes can detect injection patterns.
Example Secure LDAP Query (Escaped Input)
If a user inputs:
jsmith
The backend safely escapes it:
jsmith becomes jsmith (no change)
But if the user enters:
*)(|(uid=*))
It is escaped to:
\2a\29\28\7c\28uid=\2a\29\29
This prevents query manipulation.
Summary
LDAP Injection occurs when:
- User input is directly inserted into LDAP queries.
- Attackers exploit special characters and LDAP syntax.
- This leads to authentication bypass, data theft, privilege escalation, or server disruption.
LDAP injection is prevented by:
- Parameterized queries
- Input validation + escaping
- Least privilege directory access
- Strong authentication controls
