CVE-2025-59044
BaseFortify
Publication date: 2025-09-09
Last updated on: 2025-09-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| himmelblau | himmelblau | 0.9.22 |
| himmelblau | himmelblau | 1.0.0 |
| himmelblau | himmelblau | 0.9.0 |
| himmelblau | himmelblau | 0.9.23 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1188 | The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in Himmelblau versions 0.9.0 through 0.9.22, where numeric GIDs for Microsoft Entra ID groups are derived from the group display name by default. Since Entra ID allows multiple groups to have the same display name, different groups can end up with the same numeric GID on Linux. This causes distinct directory groups to collapse into one GID, potentially allowing unauthorized access to resources that enforce authorization by numeric GID.
How can this vulnerability impact me? :
If you use Himmelblau versions 0.9.0 through 0.9.22, any resource or service on a Himmelblau-joined host that enforces authorization by numeric GID (such as files or directories) can be unintentionally accessible to a user who creates or joins a different Entra/O365 group with the same display name as a privileged security group. This can lead to unauthorized access to sensitive resources.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your system is running Himmelblau versions 0.9.0 through 0.9.22 and if the configuration file himmelblau.conf has the setting 'id_attr_map = name'. Additionally, verify if any Entra ID groups share the same displayName, which could cause GID collisions. Specific commands are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Himmelblau to version 0.9.23 or 1.0.0 or later, where the group to GID mapping uses Entra ID object IDs (GUIDs) to avoid collisions. As a workaround until all hosts are patched, apply tenant policy hardening to restrict arbitrary group creation.