Executive brief
The LDAP / Active Directory Integration module for Drupal allows enterprises to authenticate users against their corporate directory services. An LDAP injection vulnerability in the module's search filter processing permits an attacker to discover sensitive user information beyond what they should normally be able to access, potentially exposing employee credentials, email addresses, and other directory attributes.
Technical details
An LDAP injection vulnerability exists in the Drupal LDAP / Active Directory Integration module due to improper sanitization of user-supplied input before incorporation into LDAP search filters. An unauthenticated attacker can craft malicious input during the login or user search process to inject LDAP metacharacters and expand query results to disclose additional directory information. The vulnerability is present in versions before 2.2.1 and is exploitable over the network at the authentication entry point. The module's lack of proper input validation/escaping in LDAP filter construction allows filter manipulation attacks. A patch is available in version 2.2.1.
Affected products
- Drupal LDAP / Active Directory Integration before 2.2.1
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Version 2.2.1 released with fix