LDAP injection via user-controlled input

ID

vbnet.inject.ldap_injection

Severity

high

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Inject

Language

VB.NET

Description

User-controlled input flows into an LDAP filter without neutralization, which may allow LDAP injection. Encode untrusted values with an LDAP filter encoder (e.g. LdapFilterEncode) before building the search filter.

Rationale

User-controlled input flows into an LDAP filter without neutralization, which may allow LDAP injection. Encode untrusted values with an LDAP filter encoder (e.g. LdapFilterEncode) before building the search filter.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub QueryStringToSearcherCtor(ByVal Request As HttpRequest)
    Dim user As String = Request.QueryString("user")
    Dim entry As New DirectoryEntry()
    ' VULNERABLE: LDAP injection via user-controlled input
    Dim searcher As New DirectorySearcher(entry, "(uid=" & user & ")")
    searcher.FindOne()
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References