Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
CWE-90 Base Draft
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
This vulnerability occurs when an application builds an LDAP query using untrusted user input without properly sanitizing it. An attacker can inject special characters or commands to alter the…
Definition
What is CWE-90?
This vulnerability occurs when an application builds an LDAP query using untrusted user input without properly sanitizing it. An attacker can inject special characters or commands to alter the query's logic, potentially gaining unauthorized access to, modifying, or extracting sensitive directory information.
LDAP Injection happens much like SQL injection, but targets Lightweight Directory Access Protocol queries. When user input from a form, URL parameter, or API request is directly concatenated into an LDAP search filter (like `(cn=` + userInput + `)`), an attacker can insert characters like `*`, `(`, `)`, `\`, or `null` to break the query's structure. This allows them to bypass authentication, escalate privileges, or dump the entire contents of the directory by creating filters like `*)(uid=*))(|(uid=*` that always return results.
To prevent this, developers should never construct LDAP filters by simple string concatenation. Instead, use parameterized queries or the encoding functions provided by your LDAP library (like `escapeLDAPSearchFilter` in Java or `ldap_escape` in PHP) to properly neutralize special characters. Always apply the principle of least privilege to the LDAP binding account and validate all input against a strict allow-list of expected characters before it reaches the query builder.
Auswirkungen in der Praxis
Real-world CVEs caused by CWE-90
-
Chain: authentication routine in Go-based agile development product does not escape user name (CWE-116), allowing LDAP injection (CWE-90)
-
Server does not properly escape LDAP queries, which allows remote attackers to cause a DoS and possibly conduct an LDAP injection attack.
Wie Angreifer es ausnutzen
Angreiferpfad Schritt für Schritt
- 1
Identifiziere einen Codepfad, der nicht vertrauenswürdige Eingaben ohne Validierung verarbeitet.
- 2
Erzeuge eine Payload, die das unsichere Verhalten auslöst — Injection, Traversal, Overflow oder Logik-Missbrauch.
- 3
Liefere die Payload über einen normalen Request aus und beobachte die Reaktion der Anwendung.
- 4
Iteriere, bis die Antwort Daten preisgibt, Angreifer-Code ausführt oder Berechtigungen eskaliert.
Verwundbares Codebeispiel
Vulnerable Java
The code below constructs an LDAP query using user input address data:
context = new InitialDirContext(env);
String searchFilter = "StreetAddress=" + address;
NamingEnumeration answer = context.search(searchBase, searchFilter, searchCtls); Sicheres Codebeispiel
Secure pseudo
// Validate, sanitize, or use a safe API before reaching the sink.
function handleRequest(input) {
const safe = validateAndEscape(input);
return executeWithGuards(safe);
} What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Präventions-Checkliste
How to prevent CWE-90
- Implementation Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
Erkennungssignale
How to detect CWE-90
CWE-90
Don't catalog this weakness. Prove it's reachable.
Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.
Häufig gestellte Fragen Was ist CWE-90?
Wie gravierend ist CWE-90?
Welche Sprachen oder Plattformen sind von CWE-90 betroffen?
Wie kann ich CWE-90 verhindern?
Wie erkennt und behebt Plexicus CWE-90?
Wo erfahre ich mehr über CWE-90?
Frequently asked questions
Was ist CWE-90?
This vulnerability occurs when an application builds an LDAP query using untrusted user input without properly sanitizing it. An attacker can inject special characters or commands to alter the query's logic, potentially gaining unauthorized access to, modifying, or extracting sensitive directory information.
Wie gravierend ist CWE-90?
MITRE hat für diese Schwachstelle keine Exploit-Wahrscheinlichkeit veröffentlicht. Behandle sie als mittlere Auswirkung, bis dein Threat Model anderes belegt.
Welche Sprachen oder Plattformen sind von CWE-90 betroffen?
MITRE lists the following affected platforms: Database Server.
Wie kann ich CWE-90 verhindern?
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and…
Wie erkennt und behebt Plexicus CWE-90?
Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-90 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.
Wo erfahre ich mehr über CWE-90?
MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/90.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.
Verwandte Schwachstellen
Weaknesses related to CWE-90
CWE-943 Parent
Improper Neutralization of Special Elements in Data Query Logic
This vulnerability occurs when an application builds a query for a data store (like a database) but fails to properly sanitize…
CWE-643 Sibling
Improper Neutralization of Data within XPath Expressions ('XPath Injection')
XPath Injection occurs when an application uses unvalidated user input to build an XPath query for an XML database. Without proper…
CWE-652 Sibling
Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
XQuery Injection occurs when an application uses unvalidated user input to build an XQuery expression for querying an XML database.…
CWE-89 Sibling
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL Injection occurs when an application builds a database query using untrusted user input without properly sanitizing it. This allows an…
Bereit, das Wesentliche zu validieren?
Bereit zu validieren, was zählt.
Plexicus ist Proof-Driven AppSec: validierte Funde, kontextuelles Verständnis und geprüfte Remediation — in Evidenz verankert, mit Ihnen gescoped.