sc-ldap

SC: LDAP Injection

Purpose

Detects LDAP injection vulnerabilities where user input is incorporated into LDAP search filters or Distinguished Name (DN) strings without proper escaping, allowing authentication bypass, unauthorized data access, and directory information disclosure.

Activation

Called by sc-orchestrator during Phase 2 when LDAP library usage is detected.

Phase 1: Discovery

File Patterns to Search

**/*.java, **/*.py, **/*.php, **/*.cs, **/*.go, **/*.ts, **/*.js,
**/*ldap*, **/*auth*, **/*login*, **/*directory*, **/*ad_*

Keyword Patterns to Search

"ldap_search", "ldap_bind", "ldap_connect", "ldap_modify",
"LdapConnection", "DirContext", "InitialDirContext", "SearchControls",
"ldap3", "python-ldap", "ldap.search", "DirectorySearcher",
"SearchRequest", "(&(", "(|(", "objectClass="

LDAP Filter Injection Example

// VULNERABLE: String concatenation in LDAP filter
String filter = "(&(uid=" + username + ")(userPassword=" + password + "))";
NamingEnumeration results = ctx.search("ou=users,dc=example,dc=com", filter, controls);
// Attack: username = "admin)(|(uid=*" → filter becomes (&(uid=admin)(|(uid=*)(userPassword=anything))
// This matches ALL users, bypassing password check

// SAFE: Escape special LDAP characters
String safeUsername = LdapEncoder.filterEncode(username);
String safePassword = LdapEncoder.filterEncode(password);
String filter = "(&(uid=" + safeUsername + ")(userPassword=" + safePassword + "))";

# VULNERABLE
search_filter = f"(&(uid={username})(userPassword={password}))"
conn.search('ou=users,dc=example,dc=com', search_filter)

# SAFE: Use ldap3 escape function
from ldap3.utils.conv import escape_filter_chars
safe_user = escape_filter_chars(username)
safe_pass = escape_filter_chars(password)
search_filter = f"(&(uid={safe_user})(userPassword={safe_pass}))"

// VULNERABLE
$filter = "(&(uid=$username)(userPassword=$password))";
$result = ldap_search($conn, "ou=users,dc=example,dc=com", $filter);

// SAFE
$safe_user = ldap_escape($username, '', LDAP_ESCAPE_FILTER);
$safe_pass = ldap_escape($password, '', LDAP_ESCAPE_FILTER);
$filter = "(&(uid=$safe_user)(userPassword=$safe_pass))";