CWE-90 is Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'). The flaw arises when The product builds all or part of an LDAP query from externally influenced input without correctly neutralizing special elements. The database currently holds 48 vulnerabilities mapped to CWE-90 and none of them are in the CISA Known Exploited Vulnerabilities catalog.
No vulnerability data in CISA KEV for CWE-90
The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
The product receives input influenced by an upstream component or external source and uses it to construct all or part of an LDAP query. If LDAP-special elements are not correctly neutralized, the input can be interpreted as query syntax rather than only as data. This changes the intended query structure or conditions and causes unintended behavior in the downstream LDAP component.
This weakness occurs when externally influenced input participates in LDAP query construction without correct handling of special elements. The input can cross the intended data and query-syntax boundary and alter the query's meaning at the downstream LDAP component. The record places its introduction in the implementation phase and identifies it as language-independent, with database servers as a relevant technology platform.
A modified LDAP query can affect confidentiality, integrity, and availability. Depending on the affected query and system behavior, consequences may include reading application data, modifying application data, executing unauthorized code or commands, or causing other unintended behavior such as denial of service.
| Impact | Scope | Explanation |
|---|---|---|
| Execute Unauthorized Code or Commands, Read Application Data, Modify Application Data | Confidentiality, Integrity, Availability | An attacker could include input that changes the LDAP query which allows unintended commands or code to be executed, allows sensitive data to be read or modified or causes other unintended behavior. |
Input validation: Treat all input as potentially malicious and use an accept-known-good strategy. Define allowed inputs that strictly conform to the required specifications, considering length, type, complete value ranges, missing or extra fields, syntax, consistency between related fields, and business rules. Reject nonconforming input or transform it into a conforming form. Do not rely only on denylists of malicious or malformed values, because they can miss unexpected inputs and may become bypassable when the environment changes; denylists can still help identify likely attacks or inputs that should be rejected outright.
Automated static analysis: SAST can detect some instances by analyzing source or compiled code without execution. It typically models data flow and control flow, then searches for patterns connecting input sources to sinks where data interacts with external components or lower layers. The recorded effectiveness is high, but this approach does not necessarily identify every instance.
| Method | Approach | Effectiveness |
|---|---|---|
| Automated Static Analysis | Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.) | High |
The following are representative examples, not an exhaustive list. CVE-2021-41232 involved a chain in which an authentication routine in a Go-based agile development product did not escape the user name, leading to LDAP injection. CVE-2005-2301 involved a server that did not properly escape LDAP queries, allowing remote attackers to cause denial of service and possibly conduct an LDAP injection attack.
Below are representative vulnerabilities related to this CWE, prioritized by severity.
CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Review CyStack's security rating and practical recommendations for websites and edge assets.
Explore cybersecurity research from our team of security specialists.
Browse practical cybersecurity knowledge across CyStack's articles and guides.
en
