CVE-2025-71431: Frappe LDAP Injection Vulnerability

CVE-2025-71431 Overview

CVE-2025-71431 is an LDAP injection vulnerability in the Frappe framework. Versions before 14.99.2 and 15.x before 15.86.0 are affected. Certain endpoints fail to sanitize user-supplied parameters before passing them into Lightweight Directory Access Protocol (LDAP) queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries. The weakness is tracked under CWE-90, Improper Neutralization of Special Elements used in an LDAP Query.

Critical Impact
Unauthenticated attackers can manipulate LDAP filter logic over the network to influence directory lookups and potentially disclose directory information from the backing LDAP service.

Affected Products

Frappe framework versions prior to 14.99.2
Frappe framework 15.x versions prior to 15.86.0
Deployments of ERPNext and other applications built on affected Frappe releases that enable LDAP integration

Discovery Timeline

2026-10-12 - CVE-2025-71431 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2025-71431

Vulnerability Analysis

Frappe exposes endpoints that accept user-controlled parameters and incorporate those values into LDAP search filters. The affected code paths concatenate attacker-supplied input directly into filter expressions without escaping LDAP metacharacters. This allows an attacker to inject filter operators such as *, (, ), |, and & to change query semantics. The resulting malformed or expanded filter can return records the application never intended to expose. Because the vulnerable endpoints are reachable over the network and require no authentication, exploitation requires only HTTP access to a vulnerable instance with LDAP authentication configured.

Root Cause

The root cause is missing input neutralization before LDAP query construction. Frappe passes user-supplied strings into search filters without applying RFC 4515 escaping to reserved characters. Any string that contains LDAP filter metacharacters is interpreted as filter syntax rather than literal data, which is the defining condition of CWE-90.

Attack Vector

An unauthenticated remote attacker sends HTTP requests to vulnerable Frappe endpoints that forward parameter values into LDAP queries. By substituting filter metacharacters for expected values, the attacker rewrites the intended lookup. Typical consequences include enumerating user attributes, bypassing filter restrictions on objectClass or group membership, and extracting data from the configured directory through boolean or blind inference. See the GitHub Security Advisory GHSA-qrq5-v93p-8xhw and the VulnCheck Advisory on Frappe LDAP Injection for additional technical context.

No verified proof-of-concept code has been published. The vulnerable code paths and payload shapes are described in the referenced advisories.

Detection Methods for CVE-2025-71431

Indicators of Compromise

HTTP requests to Frappe endpoints containing LDAP filter metacharacters such as *), (|, (&, or ))( within query parameters or POST bodies
Elevated or anomalous LDAP search volume from the Frappe application account against the directory server
LDAP server logs showing malformed filter errors or unusually broad filters originating from the Frappe host

Detection Strategies

Inspect application and web server logs for parameter values containing unescaped LDAP special characters sent to authentication or lookup endpoints
Correlate Frappe HTTP access logs with directory server audit logs to flag requests that produce unexpected result-set sizes
Deploy web application firewall rules that match LDAP injection payload patterns in parameters consumed by Frappe LDAP flows

Monitoring Recommendations

Enable verbose LDAP query logging on the directory server for the Frappe service account and alert on filter patterns that deviate from the application baseline
Track response-size and response-code anomalies on Frappe endpoints that trigger LDAP lookups
Baseline normal request parameter character sets and alert on inputs containing LDAP operators where they are not expected

How to Mitigate CVE-2025-71431

Immediate Actions Required

Upgrade Frappe to version 14.99.2 or later on the 14.x branch, or 15.86.0 or later on the 15.x branch
Audit Frappe deployments to identify instances with LDAP authentication enabled and prioritize those for patching
Review LDAP and application logs for the preceding 30 days to identify suspicious filter patterns against vulnerable endpoints

Patch Information

The Frappe maintainers released fixed versions 14.99.2 and 15.86.0. The fix sanitizes user-supplied parameters before they are incorporated into LDAP filters. Refer to the GitHub Security Advisory GHSA-qrq5-v93p-8xhw for the authoritative patch commit and release notes.

Workarounds

Restrict network exposure of Frappe endpoints that invoke LDAP queries to trusted networks until the upgrade is applied
Place a web application firewall in front of Frappe with rules that reject requests containing LDAP filter metacharacters in affected parameters
Reduce the privileges of the directory bind account used by Frappe so that successful injection yields the smallest possible result set

bash

# Upgrade Frappe to a patched release
bench update --upgrade
bench version | grep frappe   # confirm frappe >= 14.99.2 or >= 15.86.0