Ldap Injection in Feathersjs with Cockroachdb

LDAP Injection occurs when user-supplied input is concatenated into an LDAP query without proper validation or escaping. In a Feathersjs application that uses an LDAP backend such as Cockroachdb (via an LDAP interface or an LDAP proxy service), constructing filter strings from request parameters can lead to injection. Feathersjs is a real-time, framework-agnostic API layer; if you implement a custom service that builds LDAP filter strings using raw query parameters (e.g., username or email) and pass them to an LDAP client that ultimately routes to Cockroachdb, an attacker can manipulate the filter syntax.

For example, a naive Feathersjs service might do:

const query = req.query.query || '';
const ldapFilter = '(uid=' + query + ')';

If query is provided by the client, an attacker can supply admin)(objectClass=*) to turn the filter into (uid=admin)(objectClass=*), which can bypass authentication or extract unintended entries. Cockroachdb, when exposed through an LDAP interface, will evaluate the filter as provided; it does not inherently sanitize LDAP filter syntax. The risk is compounded if the Feathersjs service also applies dynamic sort or pagination that interacts with LDAP search results. Because middleBrick tests unauthenticated attack surfaces, it can detect unsafe concatenation patterns in OpenAPI specs and runtime probes that indicate LDAP injection vectors, even when the backend is Cockroachdb accessed via LDAP.

Moreover, if the Feathersjs app uses an OpenAPI spec that describes LDAP-specific endpoints (e.g., custom tags like ldap) and does not enforce strict input validation, middleBrick’s input validation and property authorization checks can identify missing parameter constraints. An attacker may also probe for LDAP injection via SSRF or unsafe consumption checks if the service routes user input to LDAP-related endpoints without rate limiting or proper allowlists. No authentication is required for these tests, aligning with middleBrick’s black-box approach.

To prevent LDAP Injection in a Feathersjs service that interacts with Cockroachdb over LDAP, you must treat all user input as untrusted and avoid building LDAP filter strings through concatenation. Use parameterized filter building or an LDAP library that supports structured filters. Below are concrete remediation steps with code examples.

1. Use a parameterized LDAP filter builder

Instead of string concatenation, construct filters using a library or utility that escapes special LDAP filter characters. For Cockroachdb via LDAP, ensure the filter is a valid LDAP search filter.

// Safe filter construction in a Feathersjs service hook
const escapeLDAPFilter = (str) => {
  return str.replace(/[\\*()\\x00-\\x1F\\x7F]/g, (char) => {
    return '\\' + char.charCodeAt(0).toString(16).padStart(2, '0');
  });
};

app.service('users').hooks({
  before: {
    find: (context) => {
      const { username } = context.params.query;
      if (username) {
        context.params.query.$ldapFilter = `(uid=${escapeLDAPFilter(username)})`;
      }
      return context;
    }
  }
});

2. Validate and restrict input with allowlists

Add validation in service hooks or use Feathersjs validators to ensure input conforms to expected patterns (e.g., alphanumeric usernames). This prevents injection characters from reaching the LDAP layer that interfaces with Cockroachdb.

const validator = require('feathers-hooks-common').validator;
const usernameValidator = validator({
  username: { isLength: { options: [{ min: 1, max: 64 }] }, isAlphanumeric: { options: 'en-US' } }
});

app.service('users').hooks({
  before: {
    find: [usernameValidator]
  }
});

3. Use parameterized queries if using an ORM or SQL-like layer

If Cockroachdb is accessed via a SQL-like client rather than raw LDAP, use parameterized queries to avoid injection. This does not apply to pure LDAP filters but is relevant if your Feathersjs service translates LDAP queries into SQL for Cockroachdb.

// Example using a pg-like client for Cockroachdb (not LDAP)
const { Client } = require('pg');
const client = new Client({ connectionString: 'your-cockroachdb-url' });
await client.connect();
const res = await client.query('SELECT * FROM users WHERE uid = $1', [username]);

4. Harden the OpenAPI spec

Define strict schema constraints for query parameters so that tools like middleBrick can detect insecure definitions. Specify pattern, maxLength, and required fields.

paths:
  /users:
    get:
      summary: Find users by username
      parameters:
        - name: username
          in: query
          required: false
          schema:
            type: string
            pattern: '^[a-zA-Z0-9_-]{1,64}$'
            maxLength: 64
      responses:
        '200':
          description: OK

5. Apply runtime monitoring

Enable continuous monitoring (Pro plan) to detect anomalous LDAP filter patterns against Cockroachdb. MiddleBrick’s runtime checks can flag unusual filter structures that suggest injection attempts, helping you respond before exploitation.