LDAP Injection
LDAP injection is a vulnerability where an attacker inserts crafted characters into an LDAP directory query, altering its logic to bypass authentication or read unauthorized directory entries. It occurs when untrusted input is placed into an LDAP filter without proper escaping.
LDAP injection targets applications that build LDAP directory queries — commonly used for authentication and user lookups — by concatenating untrusted input into an LDAP search filter. LDAP filter syntax uses special characters like *, (, ), \, and &; an attacker who supplies them can change a filter's meaning, for example turning a username field into *)(uid=*))(|(uid=* to match every entry or bypass a login check.
The cause mirrors other injection flaws: input intended as data is interpreted as query structure. The defense is to escape LDAP special characters according to the directory protocol's rules before inserting user input into a filter, and to prefer parameterized or framework-provided query builders that handle escaping. Input allowlisting and least-privilege bind accounts further limit impact.
Tracked as CWE-90 and part of the OWASP injection category, LDAP injection can expose the entire directory of users, groups, and attributes, and in some cases enable authentication bypass. Scanners flag LDAP filters constructed from tainted input without escaping.