What Is LDAP Injection?
LDAP injection manipulates directory-service queries through unsanitized input, in the same way SQL injection manipulates database queries. LDAP (Lightweight Directory Access Protocol) frequently backs corporate authentication and user directories, so an injection here can bypass login or expose the directory — high stakes for a comparatively obscure flaw.
How does LDAP injection work?#
LDAP search filters use a distinctive parenthesized syntax. If an app builds one by concatenating input:
Intended: (&(uid=<user>)(password=<pass>))
Input: user = *)(uid=*))(|(uid=*
Result: a filter that matches any entry → authentication bypassSpecial characters — *, (, ), \, and null — have structural meaning in filters. Injecting
them lets an attacker rewrite the query’s logic: turning a specific match into a wildcard, or an
AND into an OR, to slip past authentication or dump entries.
What can it achieve?#
| Goal | Technique |
|---|---|
| Authentication bypass | Wildcards / always-true filters |
| Information disclosure | Enumerate users and attributes |
| Privilege discovery | Read group memberships |
How do you prevent it?#
- Escape LDAP metacharacters with the framework’s LDAP encoding function — do not hand-roll it.
- Validate against an allowlist of expected characters.
- Use safe filter-building APIs rather than string concatenation.
- Apply least privilege to the directory bind account.
LDAP injection is directory-layer injection. More at the Web Security hub.
Frequently asked questions#
What is LDAP injection?
LDAP injection is an attack where unsanitized user input is placed into an LDAP directory query, letting an attacker alter the query’s logic. Because LDAP is often used for authentication, a successful injection can bypass login, enumerate directory entries, or extract attributes the user should not see. It is injection aimed at directory services.
How do you prevent LDAP injection?
Escape special characters in LDAP filters — parentheses, asterisks, backslashes, and null bytes — using the framework’s LDAP encoding function, and validate input against an allowlist. Prefer APIs that build filters safely rather than string concatenation. As with all injection, keep user input as data, never as query structure.