Description

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows LDAP Injection. This issue affects Liderahenk: from 3.4.0 before 3.5.5.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-26T14:17:08.500Z",
  "pubdate": "2026-08-26T14:17:08.500Z",
  "executiveSummary": "The Liderahenk platform is affected by an LDAP Injection vulnerability, classified as an Improper Neutralization of Special Elements used in an LDAP Query (CWE-90).\nThis vulnerability stems from the insufficient sanitization of user-supplied input before it is incorporated into dynamically constructed LDAP query strings.\nBy submitting malicious input containing LDAP meta-characters, an attacker can manipulate the query logic, potentially bypassing authentication, escalating privileges, or gaining unauthorized access to sensitive directory data.\nThe issue impacts Liderahenk versions 3.4.0 through 3.5.4.\nSuccessful exploitation allows an unauthenticated or authenticated attacker to perform unauthorized LDAP operations, potentially leading to full compromise of the underlying directory services depending on the application's LDAP service account permissions.\nOrganizations using the affected versions are at risk of data exfiltration and integrity loss regarding centralized identity management systems.",
  "technicalDetails": "The vulnerability resides in the application's handling of user input during the generation of LDAP queries. In Liderahenk, the mechanism responsible for querying directory services fails to properly encode or escape special characters—such as '*', '(', ')', '&', '|', and '!'—that carry functional meaning within the LDAP protocol syntax.\nThe root cause is the reliance on string concatenation when building query filters instead of using parameterized queries or dedicated API functions that perform automatic input neutralization. When an attacker supplies input that includes these special characters, the LDAP interpreter interprets them as logical operators or modifiers rather than literal data.\nThe exploitation flow typically involves an attacker intercepting or crafting requests sent to authentication or search modules within the Liderahenk platform. By injecting payload sequences such as 'admin)(uid=*', the attacker can alter the scope of the intended query. For instance, if the application expects to verify a single user, the injected payload could force the LDAP server to return all users or ignore subsequent conditions, such as password verification blocks.\nBecause the application logic evaluates the manipulated query results, the LDAP server may grant unauthorized access if the response indicates a 'success' condition based on the altered criteria. In scenarios where the application service account possesses high-level directory privileges, the attacker could perform arbitrary enumeration of directory objects, retrieve sensitive attributes, or modify directory contents if the query logic permits write operations.\nThis vulnerability is particularly critical because it bypasses the standard authentication flow by manipulating the server-side directory lookup logic. Since Liderahenk is designed for centralized management, successful exploitation may lead to unauthorized control over system resources managed by the platform. The vulnerability exists within the application layer, meaning the directory service itself may be functioning as intended, while the application interface facilitates the injection by failing to validate input at the perimeter.\nAffected versions are identified as 3.4.0 up to, but not including, 3.5.5. The scope of exploitation is limited to the extent of the permissions granted to the service account used by Liderahenk to connect to the directory backend."
}