Ldap Injection in Fiber with Cockroachdb

LDAP Injection occurs when an attacker can manipulate LDAP query construction through unsanitized user input. In a Fiber application that uses Cockroachdb as a backend data store, this typically happens when the app builds LDAP filter strings by concatenating user-supplied values without proper escaping. Cockroachdb, while PostgreSQL-wire compatible, does not change how LDAP filters are constructed; the database simply stores and retrieves the data used in those filters. If user input is placed directly into an LDAP filter string, special characters such as (, ), *, and \ can alter the filter logic, enabling authentication bypass, information disclosure, or server-side request forgery (SSRF) via LDAP URL schemes.

For example, a login handler that builds an LDAP filter like (&(uid=USER)(password=PASS)) is vulnerable if USER or PASS are taken directly from request parameters. An attacker supplying uid=*)(uid=admin)) as the username can change the filter semantics to return all entries, potentially authenticating as any user. Because Fiber applications often integrate with Cockroachdb for user metadata or session storage, an LDAP Injection vulnerability may also expose indirectly related data stored in Cockroachdb if the compromised LDAP query triggers broader directory access or is chained with other logic.

Additionally, if the Fiber application uses the same LDAP client to perform queries that include attributes stored in Cockroachdb (such as dynamic group memberships or tenant identifiers), attackers may leverage LDAP Injection to retrieve or modify those attributes. Since LDAP filters can include substring assertions and wildcards, improperly validated input can lead to excessive data exposure or server-side probing. The interaction between Fiber routing, Cockroachdb-stored configuration, and the LDAP library increases the attack surface when input validation and output encoding are inconsistent.

To prevent LDAP Injection in a Fiber application that references Cockroachdb, always treat user input as untrusted and escape special LDAP characters before using it in filter strings. Use a dedicated LDAP escaping function provided by your LDAP library rather than manual string manipulation. Below are concrete, realistic examples using Go with the github.com/go-ldap/ldap/v3 package and a Cockroachdb connection via pgx.

Example: Safe LDAP filter construction

package main

import (
	"context"
	"fmt"
	"github.com/go-ldap/ldap/v3"
"github.com/jackc/pgx/v5/pgxpool"
	"net/http"

	"github.com/gofiber/fiber/v2"
)

var ldapPool *ldap.Conn
var db *pgxpool.Pool

func safeFilter(input string) string {
	return ldap.EscapeFilter(input)
}

func loginHandler(c *fiber.Ctx) error {
	var creds struct {
		Username string `json:"username"`
		Password string `json:"password"`
	}
	if err := c.BodyParser(&creds); err != nil {
		return c.Status(http.StatusBadRequest).JSON(fiber.Map{"error": "invalid request"})
	}

	// Escape user input to prevent LDAP Injection
	escapedUsername := safeFilter(creds.Username)
	escapedPassword := safeFilter(creds.Password)

	// Build filter using escaped values
	searchFilter := fmt.Sprintf("(&(uid=%s)(password=%s))", escapedUsername, escapedPassword)

	// Example LDAP search (authentication step)
	searchRequest := ldap.NewSearchRequest(
		"dc=example,dc=com",
		ldap.ScopeWholeSubtree, ldap.NeverDerefAliases, 0, 0, false,
		searchFilter,
		[]string{"dn", "mail"},
		nil,
	)
	_, err := ldapPool.Search(searchRequest)
	if err != nil {
		return c.Status(http.StatusUnauthorized).JSON(fiber.Map{"error": "invalid credentials"})
	}

	// Optionally validate additional user metadata against Cockroachdb
	var email string
	if err := db.QueryRow(context.Background(),
		"SELECT email FROM users WHERE username = $1",
		creds.Username).Scan(&email); err != nil {
		return c.Status(http.StatusUnauthorized).JSON(fiber.Map{"error": "invalid credentials"})
	}

	return c.JSON(fiber.Map{"email": email})
}

In this example, ldap.EscapeFilter ensures that characters meaningful to LDAP filters are encoded, neutralizing injection attempts regardless of how the input is stored in Cockroachdb. The Cockroachdb query uses parameterized SQL (with $1) to avoid SQL Injection, keeping the authentication flow secure. The same principle applies when constructing dynamic LDAP queries that include attributes sourced from Cockroachdb: always escape before concatenation.

Example: Using parameterized queries with Cockroachdb

func getUserByUsername(ctx context.Context, db *pgxpool.Pool, username string) (string, error) {
	var email string
	row := db.QueryRow(ctx, "SELECT email, profile_data FROM user_profiles WHERE username = $1", username)
	if err := row.Scan(&email); err != nil {
		return "", err
	}
	return email, nil
}

By combining LDAP escaping on the authentication side and parameterized SQL for Cockroachdb queries, the application minimizes both LDAP Injection and SQL Injection risks. This approach aligns with secure coding practices and reduces the likelihood of attacker-controlled filter logic affecting directory services or underlying data stores.