1850
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1019 Validate Inputs 2433
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 137 Data Neutralization Issues 2311
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Technology : Database Server (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Confidentiality
Integrity
Availability
Execute Unauthorized Code or Commands
Read Application Data
Modify Application Data
An attacker could include input that changes the LDAP
query which allows unintended commands or code to be
executed, allows sensitive data to be read or modified or
causes other unintended behavior.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
CWE Version 4.14
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-90: Improper Neutralization of Special
Elements used in an LDAP Query ('LDAP Injection') 214
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use
a list of acceptable inputs that strictly conform to specifications. Reject any input that does not
strictly conform to specifications, or transform it into something that does. When performing
input validation, consider all potentially relevant properties, including length, type of input, the
full range of acceptable values, missing or extra inputs, syntax, consistency across related
fields, and conformance to business rules. As an example of business rule logic, "boat" may be
syntactically valid because it only contains alphanumeric characters, but it is not valid if the input
is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for
malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if
the code's environment changes. This can give attackers enough room to bypass the intended
validation. However, denylists can be useful for detecting potential attacks or determining which
inputs are so malformed that they should be rejected outright.
Demonstrative Examples
Example 1:
The code below constructs an LDAP query using user input address data:
Example Language: Java (Bad)
context = new InitialDirContext(env);
String searchFilter = "StreetAddress=" + address;
NamingEnumeration answer = context.search(searchBase, searchFilter, searchCtls);
Because the code fails to neutralize the address string used to construct the query, an attacker can
supply an address that includes additional LDAP queries.
Observed Examples
Reference Description
CVE-2021-41232 Chain: authentication routine in Go-based agile development product does not
escape user name (CWE-116), allowing LDAP injection (CWE-90)
https://www.cve.org/CVERecord?id=CVE-2021-41232
CVE-2005-2301 Server does not properly escape LDAP queries, which allows remote attackers
to cause a DoS and possibly conduct an LDAP injection attack.
https://www.cve.org/CVERecord?id=CVE-2005-2301
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 713 OWASP Top Ten 2007 Category A2 - Injection Flaws 629 2330
MemberOf 810 OWASP Top Ten 2010 Category A1 - Injection 809 2356
MemberOf 884 CWE Cross-section 884 2567
MemberOf 929 OWASP Top Ten 2013 Category A1 - Injection 928 2389
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1027 OWASP Top Ten 2017 Category A1 - Injection 1026 2435
MemberOf 1308 CISQ Quality Measures - Security 1305 2485
MemberOf 1340 CISQ Data Protection Measures 1340 2590
MemberOf 1347 OWASP Top Ten 2021 Category A03:2021 - Injection 1344 2490
MemberOf 1409 Comprehensive Categorization: Injection 1400 2535
Notes
Relationship
CWE Version 4.14
CWE-91: XML Injection (aka Blind XPath Injection)
CWE-91: XML Injection (aka Blind XPath Injection)