CWE-90: Failure to Sanitize Data into LDAP Queries ('LDAP Injection')
Failure to Sanitize Data into LDAP Queries ('LDAP Injection')
Weakness ID: 90 (Weakness Base)
Status: Draft
Description
Description Summary
The software does not sufficiently sanitize special elements
that are used in LDAP queries or responses, allowing attackers to modify the
syntax, contents, or commands of the LDAP query before it is
executed.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Technology Classes
Database-Server
Demonstrative Examples
Example 1
In the code excerpt below, user input data (address) isn't properly
sanitized before it's used to construct an LDAP query.
Assume all input is malicious. Use an appropriate combination of black
lists and white lists to filter or quote LDAP syntax from
user-controlled input.
Factors: resultant to special character mismanagement, MAID, or
blacklist/whitelist problems. Can be primary to authentication and
verification errors.
Research Gaps
Under-reported. This is likely found very frequently by third party code
auditors, but there are very few publicly reported examples.
Taxonomy Mappings
Mapped Taxonomy Name
Node ID
Fit
Mapped Node Name
PLOVER
LDAP injection
OWASP Top Ten 2007
A2
CWE More Specific
Injection Flaws
References
SPI Dynamics. "Web Applications and LDAP Injection".
Content History
Submissions
Submission Date
Submitter
Organization
Source
PLOVER
Externally Mined
Modifications
Modification Date
Modifier
Organization
Source
2008-07-01
Sean Eidemiller
Cigital
External
added/updated demonstrative
examples
2008-07-01
Eric Dalci
Cigital
External
updated Time of Introduction
2008-09-08
CWE Content Team
MITRE
Internal
updated Applicable Platforms, Relationships, Other Notes,
Taxonomy Mappings
Description
