CVE-2025-61911
📋 TL;DR
This vulnerability in python-ldap allows LDAP injection attacks when applications use the library's escape_filter_chars method with escape_mode=1 and pass untrusted list/dict objects as input. Attackers could potentially access or modify LDAP data they shouldn't have access to. Applications using python-ldap with custom escaping configurations are affected.
💻 Affected Systems
- python-ldap
📦 What is this software?
Python Ldap by Python Ldap
⚠️ Risk & Real-World Impact
Worst Case
Full LDAP directory compromise allowing data exfiltration, modification of user permissions, or authentication bypass.
Likely Case
Limited LDAP data disclosure or unauthorized data modification depending on application context.
If Mitigated
No impact if proper input validation and type checking are implemented before calling the vulnerable function.
🎯 Exploit Status
Requires specific application configuration and passing untrusted list/dict objects to the vulnerable function. Not trivially exploitable.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.5
Vendor Advisory: https://github.com/python-ldap/python-ldap/security/advisories/GHSA-r7r6-cc7p-4v5m
Restart Required: No
Instructions:
1. Update python-ldap package: pip install python-ldap==3.4.5
2. Verify no breaking changes in your application
3. Test LDAP functionality after update
🔧 Temporary Workarounds
Input validation wrapper
allAdd type checking before calling escape_filter_chars to ensure only string inputs are passed
def safe_escape_filter_chars(value, escape_mode=1):
if not isinstance(value, str):
raise TypeError('assertion_value must be string')
return ldap.filter.escape_filter_chars(value, escape_mode)
🧯 If You Can't Patch
- Implement strict input validation to ensure only string types are passed to escape_filter_chars
- Avoid using escape_mode=1 configuration and use default escape_mode=0 instead
🔍 How to Verify
Check if Vulnerable:
Check python-ldap version: pip show python-ldap | grep VersionCheck Version:
python -c "import ldap; print(ldap.__version__)"Verify Fix Applied:
Verify version is 3.4.5 or higher and test with list/dict inputs to ensure exceptions are raised📡 Detection & Monitoring
Log Indicators:
- TypeError exceptions from ldap.filter.escape_filter_chars
- Unexpected LDAP query patterns
Network Indicators:
- Unusual LDAP query structures containing unescaped special characters
SIEM Query:
source="application.logs" AND ("TypeError" AND "escape_filter_chars" OR "ldap injection")