What Is LDAP Injection? A Plain-English Guide for UK Businesses

What Is LDAP?

LDAP — the Lightweight Directory Access Protocol — is a standard protocol for accessing and maintaining directory information services. In a corporate context, this usually means Active Directory: the centralised system that stores information about users, computers, groups, and permissions in an organisation.

Web applications sometimes query LDAP directories directly. A login page might check a user's credentials against Active Directory rather than a local database. An internal application might use LDAP to look up an employee's details or group memberships to determine what they are authorised to do.

LDAP queries are structured strings. When a web application builds an LDAP query by inserting user-supplied input without proper handling, an attacker can inject characters that alter the meaning of the query. That is LDAP injection.

How LDAP Injection Works

Consider a web application login form. The application takes the entered username and builds an LDAP query to verify the user:

``` (&(uid=USERNAME)(password=PASSWORD)) ```

In this query, `&` means both conditions must be true — the uid must match AND the password must match. Normally the application inserts the entered username and password into those positions and runs the query against the directory.

Now suppose an attacker enters the following as the username:

``` admin)(&)) ```

If the application inserts this without validation, the resulting query becomes:

``` (&(uid=admin)(&))(password=whatever)) ```

LDAP evaluates `(&)` (an AND with no conditions) as always true. The injected structure effectively bypasses the password check — the query returns the admin user regardless of the password supplied. The attacker logs in as admin without knowing the password.

This is the authentication bypass variant of LDAP injection. Other variants allow attackers to extract directory information: by injecting wildcard characters (`*`) or manipulating filter logic, an attacker can make the directory return information it was not supposed to reveal — including other users' attributes, group memberships, or in some configurations, password hashes.

What Can LDAP Injection Enable?

Depending on how the vulnerable application uses LDAP, a successful injection can enable:

**Authentication bypass** — Logging into the application without valid credentials, typically by exploiting logical operators in the filter to always evaluate to true.

**Privilege escalation** — If the application uses LDAP to determine a user's role or group membership, injection may allow an attacker to manipulate the query to retrieve attributes that grant elevated access.

**Directory enumeration** — Extracting a list of all users, their email addresses, phone numbers, job titles, and other attributes stored in the directory. In an Active Directory environment, this can provide a complete map of the organisation's users and structure.

**Password hash extraction** — In some LDAP configurations and vulnerable applications, it may be possible to retrieve password hashes that can then be attacked offline.

The severity depends heavily on the permissions of the account the web application uses to connect to LDAP. An application that connects with a highly privileged account amplifies the impact significantly.

What Systems Are Affected?

LDAP injection vulnerabilities affect web applications and services that:

- Use LDAP for authentication (logging in against Active Directory) - Use LDAP for authorisation (checking group memberships or attributes to control access) - Use LDAP for directory searches (employee lookup tools, address book functions)

These are often internal applications — HR systems, intranets, IT service portals — but customer-facing login pages that authenticate against corporate Active Directory are equally affected. The vulnerability is in the application's code, not in LDAP or Active Directory itself.

Prevention

**Parameterised LDAP queries** — Modern LDAP libraries support safe query construction that separates the query structure from user-supplied data, preventing injection. The equivalent of parameterised queries in SQL, this is the most robust fix.

**Input validation and escaping** — If parameterised queries are not available, all user input inserted into LDAP queries must be properly escaped. The characters with special meaning in LDAP filters include `(`, `)`, `*`, `\`, `NUL`, and in distinguished names, additional characters like `,`, `+`, `"`, `<`, `>`, `;`. Escaping libraries handle this correctly where manual escaping is error-prone.

**Principle of least privilege for the LDAP service account** — The account the application uses to connect to LDAP should have only the permissions it actually needs. A login verification service needs to read user attributes; it should not have write access or the ability to query the entire directory.

**Web application firewall rules** — WAF rules can detect and block LDAP injection patterns, providing a secondary layer of defence.

**Security testing** — Because LDAP injection is an injection vulnerability, it is testable through web application security assessments. Automated scanning tools, including Yrzo AI, test for LDAP injection in forms and authentication flows as part of a full assessment.

Detection

LDAP injection is rarely visible in normal application logs because the application itself executes the malicious query as if it were legitimate. Detection typically requires:

- Web application firewall alerts for injection character patterns - LDAP query logging on the directory server, looking for unusual filter structures - Anomaly detection on successful logins — particularly accounts logging in from unexpected IP addresses or at unusual times

A web application security assessment is the most reliable way to discover LDAP injection vulnerabilities before an attacker does.

Yrzo AI tests for LDAP injection alongside 75+ other security checks, delivering a full prioritised report in under 20 minutes. Starting from £149 at yrzoai.dev.