CVE-2025-52575: EspoCRM LDAP Auth Bypass Vulnerability

CVE-2025-52575 Overview

EspoCRM is an open source Customer Relationship Management (CRM) platform. CVE-2025-52575 is a blind Lightweight Directory Access Protocol (LDAP) injection vulnerability affecting EspoCRM versions 9.1.6 and earlier when LDAP authentication is enabled. A remote, unauthenticated attacker can inject wildcard characters and LDAP filter metacharacters into the authentication input. Exploitation allows attackers to bypass authentication controls, enumerate valid usernames, or extract sensitive directory information. The maintainers fixed the issue in version 9.1.7. The weakness is tracked as [CWE-90] Improper Neutralization of Special Elements used in an LDAP Query.

Critical Impact
Unauthenticated remote attackers can manipulate LDAP queries to bypass authentication and enumerate directory contents in EspoCRM deployments using LDAP authentication.

Affected Products

EspoCRM versions 9.1.6 and earlier
Deployments with LDAP authentication enabled
Fixed in EspoCRM version 9.1.7

Discovery Timeline

2025-07-21 - CVE-2025-52575 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52575

Vulnerability Analysis

The vulnerability resides in the EspoCRM LDAP authentication flow implemented in application/Espo/Core/Authentication/Ldap/LdapLogin.php. The findLdapUserDnByUsername method concatenated the user-supplied username directly into an LDAP search filter without escaping filter metacharacters. Attackers can supply wildcard (*) and boolean characters to alter the intent of the LDAP query. Because the response reveals whether the authentication filter matched, attackers can perform blind inference against the directory. This class of flaw is categorized as LDAP Injection [CWE-90].

Root Cause

The pre-patch code built the search filter through string concatenation: (&(objectClass=...)(attribute=$username)$loginFilterString). No escaping was applied to $username, so characters with special meaning in RFC 4515 LDAP filters, including *, (, ), \, and NUL, passed through unchanged. This allowed attackers to break out of the intended filter term.

Attack Vector

An unauthenticated attacker submits a crafted username to the EspoCRM login endpoint. Wildcard payloads such as * or admin* force the LDAP server to return one or more matching entries, enabling authentication bypass or username enumeration. Repeated queries using boolean logic ()(uid=a*) and similar) allow character-by-character extraction of attributes. Exploitation requires network access to the application and an LDAP-backed authentication configuration.

php

// Security patch in application/Espo/Core/Authentication/Ldap/LdapLogin.php

    /**
-     * Find LDAP user DN by his username.
+     * Find LDAP user DN by thier username.
      *
      * @throws LdapException
      */
    private function findLdapUserDnByUsername(string $username): ?string
    {
        $ldapClient = $this->getLdapClient();
-
        $options = $this->utils->getOptions();

-        $loginFilterString = '';
+        $filterString = !empty($options['userLoginFilter']) ?
+            $this->convertToFilterFormat($options['userLoginFilter']) : '';

-        if (!empty($options['userLoginFilter'])) {
-            $loginFilterString = $this->convertToFilterFormat($options['userLoginFilter']);
-        }
+        $objectClass = $options['userObjectClass'];
+        $attribute = $options['userNameAttribute'];
+        $usernameEscaped = $this->escapeUsernameFilter($username);

-        $searchString =
-            '(&(objectClass=' . $options['userObjectClass'] . ')' .
-            '(' . $options['userNameAttribute'] . '=' . $username . ')' .
-            $loginFilterString . ')';
+        $searchString = "(&(objectClass=$objectClass)($attribute=$usernameEscaped)$filterString)";

Source: EspoCRM commit 8649f1a. The fix introduces escapeUsernameFilter to neutralize LDAP filter metacharacters before concatenation.

Detection Methods for CVE-2025-52575

Indicators of Compromise

Login attempts containing wildcard characters (*) or LDAP filter metacharacters ((, ), \, |, &) in the username field.
Elevated volumes of failed authentication events with sequentially varying usernames indicative of enumeration.
LDAP server logs showing malformed or unusually broad search filters originating from the EspoCRM service account.

Detection Strategies

Inspect EspoCRM application logs and reverse proxy access logs for POST requests to the authentication endpoint with non-alphanumeric username payloads.
Correlate LDAP directory query logs with EspoCRM authentication requests to identify filters containing unescaped wildcards.
Alert on authentication successes that immediately follow filter-manipulation patterns.

Monitoring Recommendations

Enable verbose LDAP query logging on the directory service during triage to capture the exact search filter strings.
Baseline normal authentication filter structures and alert on deviations such as additional (uid=*) clauses.
Monitor for spikes in LDAP_SUCCESS responses returning more than one entry for a single-user lookup.

How to Mitigate CVE-2025-52575

Immediate Actions Required

Upgrade EspoCRM to version 9.1.7 or later, which introduces the escapeUsernameFilter routine.
If patching is delayed, disable LDAP authentication and switch users to local authentication temporarily.
Rotate the LDAP bind service account credentials used by EspoCRM if enumeration is suspected.
Review authentication logs for prior exploitation attempts and validate directory integrity.

Patch Information

The fix is available in EspoCRM 9.1.7. See the EspoCRM Security Advisory GHSA-rjm8-77fr-4f3v and the EspoCRM commit 8649f1a for the code change that escapes LDAP filter metacharacters in the username input.

Workarounds

Place a Web Application Firewall (WAF) rule in front of EspoCRM that rejects login requests containing *, (, ), \, or NUL bytes in the username parameter.
Restrict the EspoCRM LDAP bind account to the minimum directory subtree and read attributes required for authentication.
Enforce network segmentation so that only the EspoCRM host can query the internal LDAP server.

bash

# Example ModSecurity rule to block LDAP metacharacters in the login username field
SecRule ARGS:username "@rx [\*\(\)\\|&]" \
    "id:1005252575,phase:2,deny,status:400,\
    msg:'Potential LDAP injection against EspoCRM login (CVE-2025-52575)',\
    tag:'CWE-90'"