CVE-2025-49012: Himmelblau Privilege Escalation Vulnerability

CVE-2025-49012 Overview

CVE-2025-49012 is a privilege escalation vulnerability in Himmelblau, an interoperability suite that integrates Linux systems with Microsoft Azure Entra ID and Intune. Affected versions 0.9.0 through 0.9.14 and 1.00-alpha permit access control bypass when the pam_allow_groups configuration references Entra ID groups by display name. Microsoft Entra ID allows creation of multiple groups with identical displayName values through the Microsoft Graph API. A low-privileged user can create a personal group matching a trusted access group name, add themselves to it, and gain authentication or sudo rights on Linux hosts managed by Himmelblau. The weakness is classified as [CWE-287] Improper Authentication.

Critical Impact
Authenticated Entra ID users can bypass Himmelblau group-based access controls by creating duplicate-name groups, gaining unauthorized login or sudo rights on Linux hosts.

Affected Products

Himmelblau 0.9.0 through 0.9.14
Himmelblau 1.00-alpha
Linux systems using Himmelblau pam_allow_groups with group name entries

Discovery Timeline

2025-06-05 - CVE-2025-49012 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49012

Vulnerability Analysis

Himmelblau enforces PAM-level access restrictions through the pam_allow_groups configuration directive. Starting in version 0.9.0, this directive accepted either an Entra ID group objectId (a GUID) or a human-readable displayName. The resolver in src/common/src/resolver.rs compared the user's group membership against the allow-list using both identifiers, treating either match as sufficient authorization.

Entra ID does not enforce uniqueness on the displayName attribute. Tenant defaults often permit non-administrative users to create security groups through the Microsoft Graph API. An attacker with a standard Entra ID account can create a group named identically to a privileged access group referenced in pam_allow_groups, add themselves as a member, and satisfy the name-based match check during PAM authentication.

Root Cause

The root cause is reliance on a non-unique, user-controllable attribute (displayName) as an authorization identifier. Only the immutable objectId GUID uniquely identifies an Entra ID group. The name-based comparison path in the resolver conflated identity with a mutable label.

Attack Vector

Exploitation requires an authenticated Entra ID account with permission to create groups in the tenant. The attacker enumerates group names referenced in Himmelblau configuration, creates a duplicate-named group via the Microsoft Graph API, and joins it. On next authentication against a Himmelblau-managed Linux host, the PAM stack grants access based on the spoofed group name.

rust

// Security patch in src/common/src/resolver.rs
            Ok(Some(true))
        } else {
            Ok(token.map(|tok| {
                // Never ever EVER list group names in the allowed groups set.
                // This is a SECURITY RISK! See CVE-2025-49012. Group names ARE
                // NOT unique in Entra Id. Only group Object Ids may be listed
                // here.
                let user_set: BTreeSet<_> = tok
                    .groups
                    .iter()
                    .flat_map(|g| [g.uuid.hyphenated().to_string()])
                    .chain(std::iter::once(account_id.to_string()))
                    .collect();

                debug!(

Source: Himmelblau commit 918577f

Detection Methods for CVE-2025-49012

Indicators of Compromise

Presence of multiple Entra ID groups sharing the same displayName in tenant directory queries.
Group creation events in Entra ID audit logs originating from standard (non-administrative) user accounts.
Successful PAM authentications on Himmelblau hosts by accounts not present in centrally-managed access groups.
pam_allow_groups configuration entries that reference groups by name instead of GUID.

Detection Strategies

Query the Microsoft Graph API for groups grouped by displayName and flag any name with a count greater than one.
Correlate Entra ID Add member to group audit events with subsequent SSH or console logins on Himmelblau-managed hosts.
Parse /etc/himmelblau/himmelblau.conf across the fleet to identify hosts still using name-based pam_allow_groups entries.

Monitoring Recommendations

Enable Entra ID directory audit logs and forward group lifecycle events to a SIEM for continuous review.
Alert on newly created groups whose names match entries in Himmelblau access configurations.
Track Himmelblau version inventory to identify hosts running affected releases 0.9.0 through 0.9.14 or 1.00-alpha.

How to Mitigate CVE-2025-49012

Immediate Actions Required

Upgrade Himmelblau to version 0.9.15 or later on all managed Linux hosts.
Replace every group displayName entry in pam_allow_groups with the corresponding Entra ID objectId GUID.
Audit the Entra ID tenant for duplicate group display names using the Microsoft Graph API and remove or rename unauthorized duplicates.
Restrict group creation privileges in Entra ID to administrative roles where tenant policy allows.

Patch Information

Himmelblau version 0.9.15 removes support for group name matching in pam_allow_groups. Only objectId GUIDs are accepted after the fix. See the GitHub Security Advisory GHSA-gcxr-m95v-qcf7 and the remediation commit 918577f for details.

Workarounds

Convert all pam_allow_groups entries to Entra ID objectId GUIDs without upgrading, since GUIDs remain unique and cannot be spoofed.
Use tenant governance policies to prevent non-administrative users from creating security groups.
Periodically enumerate duplicate group names via Graph API and reconcile against the authoritative group inventory.

bash

# Configuration example - post-patch himmelblau.conf
# Groups MUST be specified using their Object ID GUID.
# Group names may not be used because these names are not
# guaranteed to be unique in Entra Id.
pam_allow_groups = f3c9a7e4-7d5a-47e8-832f-3d2d92abcd12,5ba4ef1d-e454-4f43-ba7c-6fe6f1601915,admin@himmelblau-idm.org

Source: Himmelblau man page patch