Ldap Injection in Feathersjs with Api Keys

Ldap Injection occurs when user-controlled input is concatenated into an LDAP query without sanitization or parameterization, allowing attackers to manipulate the query structure. In FeathersJS, if an API route is configured to use API keys for client identification but the server-side service implementation builds LDAP filters by string concatenation, the API key value (or a field derived from it) may become part of the LDAP filter.

Consider a Feathers service that authenticates requests by validating an API key against an LDAP directory. If the implementation performs unsanitized string interpolation to build the search filter, an attacker-supplied API key can introduce LDAP metacharacters such as (, ), *, &, |, or !. For example, an API key like abc)(uid=admin) could cause the LDAP filter to become malformed, potentially bypassing intended access controls or exposing other directory entries.

FeathersJS services typically define a class with a find method that receives a params object. If the API key from params.query or from a hook is directly embedded into an LDAP filter string, the unauthenticated attack surface includes the query parameters and headers. This means an attacker can probe the endpoint without credentials, using crafted API keys to test for injection behavior. Because middleBrick scans the unauthenticated attack surface, such unsafe patterns can be detected through input validation and unsafe consumption checks.

In a typical vulnerable pattern, the service might construct a filter like (&(apikey=${userInput})(objectClass=person)). Special characters in userInput can break the filter syntax, leading to unintended subtree searches or errors that reveal information about the directory. This maps to OWASP API Top 10 categories such as Broken Object Level Authorization and Injection, and may intersect with compliance frameworks like PCI-DSS and SOC2 when directory services store sensitive identity data.

middleBrick’s LLM/AI Security checks do not apply here, but its input validation and authentication checks are designed to flag unsafe string usage and missing validation for API key formats. By scanning endpoints that rely on API keys for access control, middleBrick can surface these injection risks before they are exploited in production.

Remediation focuses on avoiding string concatenation when building LDAP filters and validating API key formats. Use parameterized LDAP queries or an abstraction that escapes special characters. In FeathersJS, implement hook logic that validates and sanitizes API keys before they are used in directory queries.

Example of a vulnerable Feathers service using API keys unsafely:

// vulnerable example
class UserService {
  async find(params) {
    const apiKey = params.query.apiKey;
    const filter = `(&(apikey=${apiKey})(objectClass=person))`;
    const results = await ldap.search({ filter });
    return results;
  }
}

Secure version with input validation and safer filter construction:

// secure example
const escapeLdapFilter = (value) => {
  if (typeof value !== 'string') return '';
  // Escape special LDAP filter characters: * ( ) \ null char
  return value.replace(/[\\*()\x00]/g, (char) => {
    return '\\' + char.charCodeAt(0).toString(16).padStart(2, '0');
  });
};

class UserService {
  async find(params) {
    const providedKey = params.query.apiKey;
    // Validate API key format before use
    if (!/^[a-zA-Z0-9\-_]{8,32}$/.test(providedKey)) {
      throw new Error('Invalid API key format');
    }
    const safeKey = escapeLdapFilter(providedKey);
    const filter = `(&(apikey=${safeKey})(objectClass=person))`;
    const results = await ldap.search({ filter });
    return results;
  }
}

Additionally, prefer using an LDAP library that supports parameterized filters or binds with identity verification rather than constructing filters from raw input. Enforce strict API key formats via schema validation in the FeathersJS query middleware:

// featherjs hook for validation
const validateApiKey = (hook) => {
  const apiKey = hook.params.query.apiKey;
  if (apiKey && !/^[a-zA-Z0-9\-_]+$/.test(apiKey)) {
    throw new Error('Invalid characters in API key');
  }
  return hook;
};

module.exports = {
  before: {
    all: [validateApiKey]
  }
};

These changes ensure API keys are treated as opaque identifiers rather than raw LDAP filter components, mitigating injection risks while preserving integration functionality.