CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Weakness ID: 90 (Weakness Base)
Status: Draft
Description
Description Summary
The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Technology Classes
Database-Server
Common Consequences
Scope
Effect
Confidentiality
Integrity
Availability
Technical Impact: Execute unauthorized code or
commands; Read application
data; Modify application
data
Demonstrative Examples
Example 1
In the code excerpt below, user input data (address) isn't properly
neutralized before it's used to construct an LDAP query.
Factors: resultant to special character mismanagement, MAID, or
blacklist/whitelist problems. Can be primary to authentication and
verification errors.
Research Gaps
Under-reported. This is likely found very frequently by third party code
auditors, but there are very few publicly reported examples.
Taxonomy Mappings
Mapped Taxonomy Name
Node ID
Fit
Mapped Node Name
PLOVER
LDAP injection
OWASP Top Ten 2007
A2
CWE_More_Specific
Injection Flaws
WASC
29
LDAP Injection
References
SPI Dynamics. "Web Applications and LDAP Injection".
Description
