CVE-2025-49012

{
  "id": "CVE-2025-49012",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-49012",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-06-09T14:47:15.271416Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "himmelblau-idm",
          "product": "himmelblau",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.9.0, < 0.9.15"
            },
            {
              "status": "affected",
              "version": "= 1.0.0-alpha"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-06-05T23:15:21.303",
  "references": [
    {
      "url": "https://github.com/himmelblau-idm/himmelblau/commit/918577f6a8392a71d9d3d67f20962c372a0c01c6",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/himmelblau-idm/himmelblau/issues/554",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-gcxr-m95v-qcf7",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://learn.microsoft.com/en-us/answers/questions/1035045/azure-ad-b2c-creates-groups-with-the-same-name-usi?utm_source=chatgpt.com",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Himmelblau versions 0.9.0 through 0.9.14 and 1.00-alpha are vulnerable to a privilege escalation issue when Entra ID group-based access restrictions are configured using group display names instead of object IDs. Starting in version 0.9.0, Himmelblau introduced support for specifying group names in the `pam_allow_groups` configuration option. However, Microsoft Entra ID permits the creation of multiple groups with the same `displayName` via the Microsoft Graph API—even by non-admin users, depending on tenant settings. As a result, a user could create a personal group with the same name as a legitimate access group (e.g., `\"Allow-Linux-Login\"`), add themselves to it, and be granted authentication or `sudo` rights by Himmelblau. Because affected Himmelblau versions compare group names by either `displayName` or by the immutable `objectId`, this allows bypassing access control mechanisms intended to restrict login to members of official, centrally-managed groups. This issue is fixed in Himmelblau version **0.9.15** and later. In these versions, group name matching in `pam_allow_groups` has been deprecated and removed, and only group `objectId`s (GUIDs) may be specified for secure group-based filtering. To mitigate the issue without upgrading, replace all entries in `pam_allow_groups` with the objectId of the target Entra ID group(s) and/or audit your tenant for groups with duplicate display names using the Microsoft Graph API."
    },
    {
      "lang": "es",
      "value": "Himmelblau es una suite de interoperabilidad para Microsoft Azure Entra ID e Intune. Las versiones de Himmelblau de la 0.9.0 a la 0.9.14 y la 1.00-alfa son vulnerables a un problema de escalada de privilegios cuando las restricciones de acceso basadas en grupos de Entra ID se configuran con nombres para mostrar de grupo en lugar de identificadores de objeto. A partir de la versión 0.9.0, Himmelblau introdujo la posibilidad de especificar nombres de grupo en la opción de configuración `pam_allow_groups`. Sin embargo, Microsoft Entra ID permite la creación de varios grupos con el mismo `displayName` mediante la API de Microsoft Graph, incluso por parte de usuarios no administradores, según la configuración del inquilino. Como resultado, un usuario podría crear un grupo personal con el mismo nombre que un grupo de acceso legítimo (p. ej., `\"Allow-Linux-Login\"`), agregarse a él y obtener permisos de autenticación o `sudo` de Himmelblau. Dado que las versiones afectadas de Himmelblau comparan los nombres de grupo mediante `displayName` o el inmutable `objectId`, esto permite eludir los mecanismos de control de acceso diseñados para restringir el inicio de sesión a los miembros de grupos oficiales administrados centralmente. Este problema se solucionó en la versión **0.9.15** de Himmelblau y posteriores. En estas versiones, la coincidencia de nombres de grupo en `pam_allow_groups` se ha descontinuado y eliminado, y solo se pueden especificar `objectId` (GUID) de grupo para el filtrado seguro basado en grupos. Para mitigar el problema sin actualizar, reemplace todas las entradas en `pam_allow_groups` con el objectId del grupo o grupos de Entra ID de destino o audite su inquilino para detectar grupos con nombres para mostrar duplicados mediante la API de Microsoft Graph."
    }
  ],
  "lastModified": "2026-06-17T09:30:40.290",
  "sourceIdentifier": "security-advisories@github.com"
}