CVE-2025-5459: Puppet Enterprise RCE Vulnerability

CVE-2025-5459 Overview

CVE-2025-5459 is a command injection vulnerability in Puppet Enterprise that allows authenticated users with node group editing permissions to execute commands as root on the primary host. The flaw stems from improper handling of class parameters [CWE-78]. An attacker who already holds node group editing privileges can craft a malicious class parameter that the primary host evaluates with root-level authority. The vulnerability affects Puppet Enterprise versions 2018.1.8 through 2023.8.3, and 2025.3. Perforce resolved the issue in versions 2023.8.4 and 2025.4.0.

Critical Impact
A privileged user can escalate to root code execution on the Puppet primary host, compromising the entire managed infrastructure.

Affected Products

Puppet Enterprise 2018.1.8 through 2023.8.3
Puppet Enterprise 2025.3
Puppet primary host components processing node group class parameters

Discovery Timeline

2025-06-26 - CVE-2025-5459 published to NVD
2025-10-14 - Last updated in NVD database

Technical Details for CVE-2025-5459

Vulnerability Analysis

The vulnerability is classified as OS Command Injection [CWE-78]. Puppet Enterprise allows administrators to assign classes and parameters to node groups through its console and API. The class parameter input is not properly sanitized before being incorporated into a context that executes on the primary host. When the primary applies the configuration, the injected payload runs with root privileges.

Because the Puppet primary host orchestrates configuration management across the entire managed fleet, root-level execution on this host provides control over agent nodes, secrets, certificates, and infrastructure code. The attack requires network access to the Puppet Enterprise console or API and authenticated access with node group editing rights.

Root Cause

The root cause is missing or insufficient input validation on class parameter values supplied through node group editing workflows. Specially crafted parameter content is interpreted as a command rather than as inert configuration data, allowing shell-level execution under the Puppet primary process context, which runs as root.

Attack Vector

An authenticated user with node group editing permissions submits a class parameter containing a crafted payload. The Puppet Enterprise primary processes the value and executes commands as root during catalog compilation or application. Refer to the Perforce Security Advisory for vendor-supplied technical context. No public proof-of-concept exploit is available at this time.

Detection Methods for CVE-2025-5459

Indicators of Compromise

Unexpected child processes spawned by the Puppet primary service (pe-puppetserver, pe-console-services) executing shell commands or scripts.
Audit log entries in the Puppet Enterprise console showing node group or class parameter modifications by non-administrative accounts.
New or modified files in /opt/puppetlabs/ or /etc/puppetlabs/ outside of normal change windows.
Outbound network connections from the Puppet primary host to unfamiliar destinations.

Detection Strategies

Review Puppet Enterprise activity service logs for class parameter changes containing shell metacharacters such as backticks, semicolons, or command substitution syntax.
Monitor process ancestry on the primary host for non-standard processes parented by Puppet services.
Correlate API calls to /classifier-api/v1/groups with subsequent suspicious process execution on the primary.

Monitoring Recommendations

Forward Puppet Enterprise audit logs and primary host system logs to a centralized SIEM for correlation.
Alert on root-owned processes executed by Puppet services that deviate from baseline command patterns.
Track and review all accounts holding node group editing permissions on a recurring basis.

How to Mitigate CVE-2025-5459

Immediate Actions Required

Upgrade Puppet Enterprise to version 2023.8.4 or 2025.4.0 as soon as feasible.
Audit all user accounts and roles with node group editing permissions and revoke access not strictly required.
Review recent node group and class parameter modifications for unexpected changes prior to patching.

Patch Information

Perforce has released fixed versions 2023.8.4 and 2025.4.0 that resolve the command injection in class parameter handling. Patch details and download links are available in the Perforce Security Advisory. Apply patches following standard Puppet Enterprise upgrade procedures and verify primary host integrity after upgrade.

Workarounds

Restrict node group editing permissions to a minimal set of trusted administrators until the patch is applied.
Enforce multi-factor authentication on all Puppet Enterprise console and API accounts.
Place the Puppet Enterprise console behind network segmentation that limits access to authorized administrative networks.

bash

# Configuration example: list users with node group editing rights via Puppet RBAC API
curl -k -H "X-Authentication: $TOKEN" \
  https://puppet.example.com:4433/rbac-api/v1/users \
  | jq '.[] | select(.role_ids != null) | {login, role_ids}'