LDAP injection (ARCH317)

Key dotnet.security.ldap-injection · Severity error · Category security · CWE CWE-90

Concatenating user input into an LDAP filter lets an attacker alter the filter logic and bypass authorization. Escape the input.

Incorrect

var search = new DirectorySearcher(entry)
{
    Filter = "(uid=" + userName + ")"
};

Correct

var safe = Regex.Replace(userName, @"[\\*()\u0000/]",
    m => "\\" + ((byte)m.Value[0]).ToString("X2"));
var search = new DirectorySearcher(entry) { Filter = "(uid=" + safe + ")" };

Fix

Escape all input per RFC 4515 rules before embedding it in LDAP filters.