Description

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-02T13:18:12.803Z",
  "pubdate": "2026-09-02T13:18:12.803Z",
  "executiveSummary": "The Drupal LDAP / Active Directory Integration module contains an Improper Neutralization of Special Elements used in an LDAP Query vulnerability, classified as LDAP Injection (CWE-90).\nThis vulnerability affects versions from 0.0.0 up to and including 2.2.1.\nThe flaw exists because the module fails to adequately sanitize user-supplied input before incorporating it into backend LDAP query strings.\nAn unauthenticated or authenticated attacker can leverage this weakness to manipulate the structure of LDAP queries executed against the directory server.\nSuccessful exploitation allows an attacker to bypass authentication mechanisms, gain unauthorized access to sensitive directory information, or potentially escalate privileges within the Drupal environment.\nThe risk is significant as it compromises the integrity of the authentication and authorization provider, potentially leading to full account takeover or unauthorized data exfiltration.\nExploitation does not necessarily require complex environmental conditions, making it a critical concern for any deployment utilizing the affected module for identity management.",
  "technicalDetails": "The core vulnerability is identified as an LDAP Injection vulnerability (CWE-90) stemming from the insufficient sanitization of user-provided input that is subsequently dynamically concatenated into LDAP filter strings.\nIn the context of the Drupal LDAP / Active Directory Integration module, various functionalities—such as login forms, user search, or profile synchronization—process input variables that are expected to interact with the directory server.\nIf the module fails to utilize proper escaping functions (e.g., ldap_escape) for values placed inside the filter argument of an LDAP search operation, an attacker can inject LDAP metacharacters such as parentheses '()', asterisks '*', ampersands '&', or vertical bars '|'.\nAn attack flow typically begins with an attacker injecting malicious sequences into an input field, such as a username or search parameter. For example, by providing a payload like 'admin)(&)', the attacker can alter the query logic from '(uid=admin)' to '(uid=admin)(&))'. Depending on the backend implementation, this may cause the LDAP server to evaluate the injected condition, potentially leading to a successful bypass of password checks if the server returns a 'true' result for the modified filter.\nBeyond authentication bypass, an attacker can perform blind LDAP injection. By carefully crafting payloads, an attacker can infer the existence of users, group memberships, or sensitive attributes within the directory by observing the differences in the application's response (e.g., successful login vs. error message vs. time-based variations).\nThe vulnerable component resides within the query construction logic of the module where LDAP filters are dynamically generated. Since LDAP queries are often performed to verify credentials or retrieve user objects, the impact is pervasive across the Drupal site's authentication infrastructure.\nThe issue affects versions 0.0.0 through 2.2.1. The lack of strict input neutralization means that any entry point that forwards user-controlled data to the LDAP query engine is a potential vector for exploitation. The severity is elevated because LDAP directories often store global organization data, meaning a compromise of this query mechanism could result in the exposure of data well beyond the scope of a single Drupal instance."
}