143 lines
7.1 KiB
JSON
143 lines
7.1 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.1",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2025-49012",
|
|
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "GitHub_M",
|
|
"dateReserved": "2025-05-29T16:34:07.176Z",
|
|
"datePublished": "2025-06-05T22:29:40.744Z",
|
|
"dateUpdated": "2025-06-09T14:47:19.431Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"title": "Himmelblau's Name-Based Group Matching in `pam_allow_groups` Leads to Potential Security Bypass",
|
|
"problemTypes": [
|
|
{
|
|
"descriptions": [
|
|
{
|
|
"cweId": "CWE-287",
|
|
"lang": "en",
|
|
"description": "CWE-287: Improper Authentication",
|
|
"type": "CWE"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"attackComplexity": "LOW",
|
|
"attackVector": "NETWORK",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 5.4,
|
|
"baseSeverity": "MEDIUM",
|
|
"confidentialityImpact": "LOW",
|
|
"integrityImpact": "LOW",
|
|
"privilegesRequired": "LOW",
|
|
"scope": "UNCHANGED",
|
|
"userInteraction": "NONE",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
|
|
"version": "3.1"
|
|
}
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"name": "https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-gcxr-m95v-qcf7",
|
|
"tags": [
|
|
"x_refsource_CONFIRM"
|
|
],
|
|
"url": "https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-gcxr-m95v-qcf7"
|
|
},
|
|
{
|
|
"name": "https://github.com/himmelblau-idm/himmelblau/issues/554",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://github.com/himmelblau-idm/himmelblau/issues/554"
|
|
},
|
|
{
|
|
"name": "https://github.com/himmelblau-idm/himmelblau/commit/918577f6a8392a71d9d3d67f20962c372a0c01c6",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://github.com/himmelblau-idm/himmelblau/commit/918577f6a8392a71d9d3d67f20962c372a0c01c6"
|
|
},
|
|
{
|
|
"name": "https://learn.microsoft.com/en-us/answers/questions/1035045/azure-ad-b2c-creates-groups-with-the-same-name-usi?utm_source=chatgpt.com",
|
|
"tags": [
|
|
"x_refsource_MISC"
|
|
],
|
|
"url": "https://learn.microsoft.com/en-us/answers/questions/1035045/azure-ad-b2c-creates-groups-with-the-same-name-usi?utm_source=chatgpt.com"
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"vendor": "himmelblau-idm",
|
|
"product": "himmelblau",
|
|
"versions": [
|
|
{
|
|
"version": ">= 0.9.0, < 0.9.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "= 1.0.0-alpha",
|
|
"status": "affected"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"providerMetadata": {
|
|
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
|
|
"shortName": "GitHub_M",
|
|
"dateUpdated": "2025-06-05T22:29:40.744Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs. Starting in version 0.9.0, Himmelblau introduced support for specifying group names in the `pam_allow_groups` configuration option. However, Microsoft Entra ID permits the creation of multiple groups with the same `displayName` via the Microsoft Graph API—even by non-admin users, depending on tenant settings. As a result, a user could create a personal group with the same name as a legitimate access group (e.g., `\"Allow-Linux-Login\"`), add themselves to it, and be granted authentication or `sudo` rights by Himmelblau. Because affected Himmelblau versions compare group names by either `displayName` or by the immutable `objectId`, this allows bypassing access control mechanisms intended to restrict login to members of official, centrally-managed groups. This issue is fixed in Himmelblau version **0.9.15** and later. In these versions, group name matching in `pam_allow_groups` has been deprecated and removed, and only group `objectId`s (GUIDs) may be specified for secure group-based filtering. To mitigate the issue without upgrading, replace all entries in `pam_allow_groups` with the objectId of the target Entra ID group(s) and/or audit your tenant for groups with duplicate display names using the Microsoft Graph API."
|
|
}
|
|
],
|
|
"source": {
|
|
"advisory": "GHSA-gcxr-m95v-qcf7",
|
|
"discovery": "UNKNOWN"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"timestamp": "2025-06-09T14:47:15.271416Z",
|
|
"id": "CVE-2025-49012",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "partial"
|
|
}
|
|
],
|
|
"role": "CISA Coordinator",
|
|
"version": "2.0.3"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2025-06-09T14:47:19.431Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |