CWE-90 LDAP Injection
What this means
SiteShadow flagged an LDAP query (filter / DN / search base) that is being constructed using untrusted input. LDAP has its own "query language" rules—string concatenation can let attackers change the meaning of the search.
Why it matters
LDAP injection can bypass auth or exfiltrate directory data.
- Auth bypass: attackers can turn a "match this user" filter into "match anyone".
- Directory enumeration: read attributes/groups you didn't intend to expose.
- Privilege escalation: if group membership checks rely on injectable filters.
Safer examples
1) Escape user-controlled values for LDAP filters (Python)
from ldap3.utils.conv import escape_filter_chars
username = escape_filter_chars(user_input)
ldap_filter = f"(uid={username})"2) Don't build complex filters from user input
If users are selecting a field/search mode, allowlist it (e.g., only uid or mail) and keep the value escaped.
3) Restrict what can be searched and returned
- Use a dedicated service account with least privilege.
- Limit searchable bases and returned attributes.
How SiteShadow detects it (high level)
- Detects LDAP query/filter construction and tracks whether parts come from request/user-controlled values.
- Flags cases where escaping/allowlisting is missing, especially near auth/group checks.
References
- CWE-90: https://cwe.mitre.org/data/definitions/90.html
---