Review code for LDAP injection vulnerabilities
Review code for LDAP injection vulnerabilities
Microsoft docsDescription
When working with untrusted input, be mindful of Lightweight Directory Access Protocol (LDAP) injection attacks. An attacker can potentially run malicious LDAP statements against information directories. Applications that use user input to construct dynamic LDAP statements to access directory services are particularly vulnerable.
This rule attempts to find input from HTTP requests reaching an LDAP statement. This rule can't track data across assemblies. For example, if one assembly reads the HTTP request input and then passes it to another assembly that executes an LDAP statement, this rule won't produce a warning. There is a configurable limit to how deep this rule will analyze data flow across method calls. See Analyzer Configuration for how to configure the limit in an EditorConfig file.
Cause
Potentially untrusted HTTP request input reaches an LDAP statement.
By default, this rule analyzes the entire codebase, but this is configurable.
How to fix violations
For the user-controlled portion of LDAP statements, consider one o:
- Allow only a safe list of non-special characters.
- Disallow special character
- Escape special characters.
See OWASP's LDAP Injection Prevention Cheat Sheet for more guidance.
Example
using System;
using System.DirectoryServices;
public partial class WebForm : System.Web.UI.Page
{
protected void Page_Load(object sender, EventArgs e)
{
string userName = Request.Params["user"];
string filter = "(uid=" + userName + ")"; // searching for the user entry
// In this example, if we send the * character in the user parameter which will
// result in the filter variable in the code to be initialized with (uid=*).
// The resulting LDAP statement will make the server return any object that
// contains a uid attribute.
DirectorySearcher searcher = new DirectorySearcher(filter);
SearchResultCollection results = searcher.FindAll();
// Iterate through each SearchResult in the SearchResultCollection.
foreach (SearchResult searchResult in results)
{
// ...
}
}
}When to suppress
If you know the input has been validated or escaped to be safe, it's okay to suppress this warning.