php-ldap-audit

PHP LDAP injection audit (php-ldap-audit)

Analyze PHP project source code, identify LDAP query-related code (filter/DN construction), and detect LDAP injection risks: an attacker can alter LDAP query semantics by controlling filter or DN fragments, thereby causing unauthorized queries, data leakage, or authentication bypass.

Grading and numbering

• See details:shared/SEVERITY_RATING.md
• Vulnerability ID:{C/H/M/L}-LDAP-{序号}

LDAP Sink (required)

Identify the following functions/statements as the final execution points:

• ldap_search({value}) / ldap_read({value}) / ldap_list({value})
• as well as their project wrappers (as long as the filter/DN string is ultimately passed in)

Required evidence points (required, trace contract alignment)

Each suspected LDAP vulnerability must item by item reference php-route-tracer in the trace ## 9) Sink Evidence Type Checklist the LDAP linecorresponding evidence point ID:

1. EVID_LDAP_EXEC_POINT: LDAP query execution point (ldap_* function call/wrapper final parameter passing location) evidence
2. EVID_LDAP_FILTER_STRING_CONSTRUCTION: LDAP filter/DN string construction location (concatenation/templating) evidence
3. EVID_LDAP_USER_PARAM_TO_FILTER_FRAGMENT: mapping evidence from user-controllable parameters to filter/DN fragments

Controllability and injection point confirmation (required)

Must output and determine:

• Where user input comes from:$_GET/$_POST/json/php://input/$_COOKIE/$_FILES or its derived fields
• How the filter/DN is constructed: whether direct string concatenation, whether escaping is applied, whether an allowlist exists
• Semantic points that injection can alter: for example, whether characters related to LDAP filter syntax such as *、(、) can be injected (or escaping bypassed through encoding)
• Whether escaping/sanitization exists: preferentially use ldap_escape(or a custom equivalent function), and it must be provable that it is used in the final filter/DN construction

Tracer trigger conditions (required)

When any condition is met, php-route-tracershould be triggered (or equivalent deep tracing):

• The filter/DN is concatenated from multiple variables/function levels or concatenated after JSON decoding
• The filter/DN enters ldap_search/read/list there are branches (if/switch/try) or early return/throw before it
• The escaping logic has conditional branches (some branches do not escape, or only escape some fields)

Report output

Output to:

{output_path}/vuln_audit/ldap_{timestamp}.md

Vulnerability entry template (mandatory)

Each LDAP vulnerability must contain the following structure:

### [{等级前缀}-LDAP-{序号}] LDAP 注入漏洞（filter/DN 拼接导致查询语义被改变）

| 项目 | 信息 |
|------|------|
| 严重等级 | {🔴/🟠/🟡/🔵} (CVSS {score}) |
| 可达性 (R) | {0-3} - {理由} |
| 影响范围 (I) | {0-3} - {理由} |
| 利用复杂度 (C) | {0-3} - {理由} |
| 可利用性 | ✅ 已确认 / ⚠️ 待验证 / ❌ 不可利用 / 🔍 环境依赖 |
| 位置 | {file}:{line} ({Function}) |

#### 数据流链（Source → Sink）
(按路由逐行写出：输入读取 -> 变量拼接/转换/转义 -> filter/DN 最终生成 -> 调用 ldap_* 执行，禁止省略)

#### 可利用前置条件
- 鉴权要求：{无需/需登录/需特定权限}
- 输入可控性：{完全可控/条件可控/不可控}
- 触发条件：{分支/异常/环境依赖}
- 转义/白名单可靠性：{已可靠防护/防护缺失/防护可绕过}

#### 证据引用（强制：来自 php-route-tracer）
- `EVID_LDAP_EXEC_POINT`：{对应证据要点简述}
- `EVID_LDAP_FILTER_STRING_CONSTRUCTION`：{对应证据要点简述}
- `EVID_LDAP_USER_PARAM_TO_FILTER_FRAGMENT`：{对应证据要点简述}

#### 验证 PoC（强制：给出可执行请求）
```http
{HTTP Method} {真实路由与完整参数} HTTP/1.1
Host: {host}
{必要 Cookie/Auth}

{Payload}

PoC generation strategy (must be written clearly):

• First use a "probe payload" to prove the filter/DN is evaluated (return count/status code/response difference)
• Then use an "injection payload" to prove the query semantics can be altered (such as expanding the match range/bypassing conditions)

Recommended remediation

• Use ldap_escape($value, '', LDAP_ESCAPE_FILTER)(or an equivalent function) to strictly escape user input in the filter
• Apply an allowlist to controllable fields (only allow a legal character set, fixed attribute names, and limit length)
• Prohibit direct string concatenation for filter/DN; instead use parameterized/templated safe assembly (even though PHP has no native LDAP parameterization, strict assembly must still be done at the code layer)
• Provide code search statements (rg) to locate all filter/DN concatenation points

## tracer 证据缺失处理（强制）
- 若 trace 契约的 LDAP 行中任一关键证据点（`EVID_LDAP_EXEC_POINT / EVID_LDAP_FILTER_STRING_CONSTRUCTION / EVID_LDAP_USER_PARAM_TO_FILTER_FRAGMENT`）缺失或无法对应到本条漏洞：状态只能标记为 `⚠️待验证`，不得直接给出 `✅已确认可利用`。