LDAP Injection in Vibe Coded Apps

What is LDAP injection?

LDAP injection is a vulnerability where attackers manipulate Lightweight Directory Access Protocol queries by inserting special characters into user input fields. It targets enterprise directory services like Active Directory, Azure AD (now Entra ID), and OpenLDAP.

Think of it like SQL injection, but for enterprise authentication systems. Instead of attacking a database with ' OR '1'='1, attackers use LDAP filter syntax with characters like *, (, ), &, and |.

According to the Verizon 2025 Data Breach Investigations Report, 88% of breaches involve compromised credentials. LDAP injection is one way attackers bypass credential verification entirely. CWE-90 classifies this as "Improper Neutralization of Special Elements used in an LDAP Query."

Why does LDAP injection matter for enterprise apps?

LDAP powers authentication for millions of enterprise applications through Active Directory, SSO systems, and employee directories. If you're vibe coding enterprise SaaS with SSO or building internal tools that authenticate against corporate directories, LDAP injection directly affects you.

Recent high-profile vulnerabilities demonstrate the severity:

• CVE-2024-49113 (CVSS 9.8): Windows LDAP remote code execution vulnerability known as "LDAPNightmare"
• CVE-2025-54918: NTLM LDAP authentication bypass enabling SYSTEM-level escalation
• CVE-2024-37782: Gladinet CentreStack LDAP injection through username field

How does LDAP injection work?

LDAP injection works by inserting special characters that modify the structure of LDAP filter queries. The most common attack bypasses authentication by truncating the filter logic.

// Vulnerable LDAP filter with user input
const filter = `(&(uid=${username})(userPassword=${password}))`

// Normal input:
// username = "admin", password = "secret123"
// Filter: (&(uid=admin)(userPassword=secret123))

// Attack input:
// username = "admin)(&", password = "anything"
// Filter: (&(uid=admin)(&)(userPassword=anything))
//                       ^ Always true! Password check ignored

// Attack payload: username = "*"
// Filter: (&(uid=*)(userPassword=anything))
// Result: Matches ANY user in the directory

// Attack payload: username = "a*"
// Filter: (&(uid=a*)(userPassword=test))
// Result: Enumerate all users starting with 'a'

Why do AI tools generate vulnerable LDAP code?

AI tools generate insecure LDAP authentication because their training data includes enterprise examples without proper escaping. When you ask Cursor or Claude Code to build Active Directory authentication, they generate string concatenation patterns.

// What Cursor typically generates (VULNERABLE)
async function authenticate(username, password) {
  const filter = `(&(uid=${username})(userPassword=${password}))`
  const result = await ldapClient.search('ou=users,dc=example,dc=com', {
    filter: filter
  })
  return result.searchEntries.length > 0
}

// What Bolt generates for quick auth endpoints (VULNERABLE)
app.post('/api/login', async (req, res) => {
  const { username, password } = req.body
  const filter = `(&(cn=${username})(userPassword=${password}))`
  const result = await ldap.search('dc=example,dc=com', { filter })
  res.json({ authenticated: result.length > 0 })
})

Why this happens:

• Training data bias: Enterprise auth examples in training data rarely show LDAP-specific escaping
• LDAP obscurity: Less documentation about LDAP injection than SQL injection
• String concatenation is simpler: AI generates the most straightforward working code
• No security context: AI doesn't know your code handles untrusted user input

What could happen if I have LDAP injection?

LDAP injection against enterprise directories can compromise your entire organization's authentication system.

• Authentication bypass: Log in as any user without knowing their password using admin)(&
• Privilege escalation: Access admin accounts or modify group memberships
• Data exfiltration: Extract employee records, emails, and organizational data from the directory
• Lateral movement: Use compromised credentials to access other enterprise systems
• Directory enumeration: Map all users, groups, and organizational structure

How do I detect LDAP injection?

Detect LDAP injection by searching for code that builds LDAP filters using string concatenation or template literals with user input.

// String interpolation in LDAP filters (DANGEROUS)
`(&(uid=${username})`
`(cn=${user})`
filter = f"(&(uid={username})"

// Template literals with req.body (DANGEROUS)
filter: `(&(uid=${req.body.username})`

// No escaping before filter construction (DANGEROUS)
ldapClient.search(baseDN, { filter: userInput })

// Regex patterns to find these:
// \(\s*(&|\|)\s*\([^)]*\$\{
// ldap.*search.*\$\{
// filter.*=.*[fF]".*\{

Quick manual test: Enter admin)(& as a username in your login form. If authentication succeeds with any password, you have LDAP injection.

How do I fix LDAP injection?

Fix LDAP injection by escaping special characters before including user input in LDAP filters. Use library-provided methods instead of building filter strings manually.

// String interpolation - DANGEROUS
async function authenticate(username, password) {
  const filter = `(&(uid=${username})(userPassword=${password}))`
  const result = await ldapClient.search(
    'ou=users,dc=example,dc=com',
    { filter: filter }
  )
  return result.searchEntries.length > 0
}

// Attack: username="admin)(&" bypasses auth

// Use Filter objects - SAFE
import { EqualityFilter, AndFilter } from 'ldapjs'

async function authenticate(username, password) {
  // Validate input format first
  if (!/^[a-zA-Z0-9._-]+$/.test(username)) {
    throw new Error('Invalid username format')
  }

  const filter = new AndFilter({
    filters: [
      new EqualityFilter({ attribute: 'uid', value: username }),
      new EqualityFilter({ attribute: 'userPassword', value: password })
    ]
  })

  const result = await ldapClient.search(
    'ou=users,dc=example,dc=com',
    { filter: filter.toString() }
  )
  return result.searchEntries.length > 0
}

# f-string interpolation - DANGEROUS
def authenticate(username, password):
    filter = f"(&(uid={username})(userPassword={password}))"
    conn.search(base_dn, filter)
    return len(conn.entries) > 0

# Attack: username="admin)(&" bypasses auth

# Use escape_filter_chars - SAFE
from ldap3.utils.conv import escape_filter_chars
import re

def authenticate(username, password):
    # Validate input format first
    if not re.match(r'^[a-zA-Z0-9._-]+$', username):
        raise ValueError('Invalid username format')

    safe_user = escape_filter_chars(username)
    safe_pass = escape_filter_chars(password)
    filter = f"(&(uid={safe_user})(userPassword={safe_pass}))"

    conn.search(base_dn, filter)
    return len(conn.entries) > 0

new EqualityFilter({ attribute: 'uid', value: username })

escape_filter_chars(username)

/^[a-zA-Z0-9._-]+$/.test(username)

// Bind with service account, not admin

How does LDAP injection compare to other injection attacks?

LDAP injection follows the same principle as SQL and NoSQL injection - exploiting unvalidated user input in queries. The main difference is the query language and target system.

Frequently asked questions

Related content