Description

Detects LDAP search injection vulnerabilities in Rust code that uses the ldap3 library. When user input is directly passed to LDAP search operations without proper sanitization, attackers can manipulate LDAP queries to access unauthorized data or bypass authentication mechanisms.

Detection Strategy

• The vulnerability is reported when the ldap3 library is imported in the Rust code

• A function call or method invocation is identified that performs LDAP search operations

• The arguments passed to the LDAP search function contain unsanitized user input or untrusted data sources

• The detector validates that the identified pattern represents a vulnerable LDAP search sink where injection could occur

Vulnerable code example

use actix_web::{get, web, HttpResponse};
use ldap3::{LdapConn, Scope};
use std::collections::HashMap;

#[get("/search")]
async fn search_users(query: web::Query<HashMap<String, String>>) -> HttpResponse {
    let uid = query.get("uid").unwrap();
    ...

✅ Secure code example

use actix_web::{get, web, HttpResponse};
use ldap3::{LdapConn, Scope};
use std::collections::HashMap;

#[get("/search")]
async fn search_users(query: web::Query<HashMap<String, String>>) -> HttpResponse {
    let uid = query.get("uid").unwrap();
    ...