{
  "slug": "ldap-injection",
  "url": "https://library.infinity8labs.com/ldap-injection/",
  "title": "LDAP injection",
  "short": "LDAP injection",
  "aliases": [
    "LDAP filter injection",
    "Directory query injection",
    "Lightweight Directory Access Protocol injection"
  ],
  "summary": "LDAP injection occurs when untrusted input changes the structure of a directory query. It can bypass authentication, broaden searches, disclose directory data, or modify records beyond the intended scope.",
  "cwe": [
    "CWE-90"
  ],
  "owasp": "A03:2021 Injection",
  "typical_severity": {
    "min": "medium",
    "max": "critical"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-90: Improper Neutralization of Special Elements used in an LDAP Query",
      "url": "https://cwe.mitre.org/data/definitions/90.html"
    },
    {
      "title": "OWASP LDAP Injection Prevention Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html"
    },
    {
      "title": "OWASP LDAP Injection",
      "url": "https://owasp.org/www-community/attacks/LDAP_Injection"
    },
    {
      "title": "OWASP Top 10 A03:2021 Injection",
      "url": "https://owasp.org/Top10/A03_2021-Injection/"
    },
    {
      "title": "Oracle Java DirContext search documentation",
      "url": "https://docs.oracle.com/en/java/javase/21/docs/api/java.naming/javax/naming/directory/DirContext.html"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/ldap-injection/#overview",
    "https://library.infinity8labs.com/ldap-injection/#impact",
    "https://library.infinity8labs.com/ldap-injection/#examples",
    "https://library.infinity8labs.com/ldap-injection/#remediation",
    "https://library.infinity8labs.com/ldap-injection/#testing",
    "https://library.infinity8labs.com/ldap-injection/#references"
  ]
}