Java : LDAP injection

LDAP query injection is possible. This can lead to data confidentiality loss or to data modification.

Injection vulnerabilities take the first place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

LDAP is an application-level protocol for accessing and maintaining distributed directory information services (X.500 directory service). If LDAP query is based on data from an untrusted source (e.g., user input) and the data do not pass validation, an attacker can modify the query and execute it with the application rights.

The application creates an LDAP query generated based on data from an untrusted source that has not been validated. This allows an attacker to change the semantics of the query.