Zennoxa Shield
Rules / C#
SHIELD-CSHARP-017

LDAP injection via DirectorySearcher filter

highC#CWE-90CVSS 8.1

What it detects

A DirectorySearcher filter is built by concatenating untrusted input into the LDAP query.

How to fix

Escape LDAP special characters in user input before building the search filter.

Vulnerable — Shield flags thisUserDirectorySearch.cs
using System.DirectoryServices;

public class UserDirectorySearch
{
    public SearchResult FindUser(string userName)
    {
        var searcher = new DirectorySearcher();
        searcher.Filter = $"(&(objectClass=user)(uid={userName}))"; // LDAP injection
        return searcher.FindOne();
    }
}
Fixed — scans cleanUserDirectorySearch.cs
using System.DirectoryServices;

public class UserDirectorySearch
{
    public SearchResult FindUser(string userName)
    {
        string safe = userName.Replace(@"\", @"\5c").Replace("*", @"\2a")
                              .Replace("(", @"\28").Replace(")", @"\29");
        var searcher = new DirectorySearcher();
        searcher.Filter = string.Format("(&(objectClass=user)(uid={0}))", safe);
        return searcher.FindOne();
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-017, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-017: LDAP injection via DirectorySearcher filter — Zennoxa Shield