CVE-2025-58174: LDAP Account Manager Stored XSS Vulnerability

CVE-2025-58174 Overview

CVE-2025-58174 is a stored cross-site scripting (XSS) vulnerability in LDAP Account Manager (LAM), a web frontend for managing entries in an LDAP directory. The flaw affects LAM versions prior to 9.3 and resides in the Profile section. The application renders the profile name field as HTML without sanitization, allowing an authenticated user with profile creation or edit permissions to inject and execute a script payload. The payload triggers when any user views the affected profile data in a browser. The issue is tracked under CWE-79 and is resolved in LAM version 9.3.

Critical Impact
An authenticated attacker can execute arbitrary JavaScript in the browser session of any user who views a maliciously crafted LAM profile, enabling session theft, credential harvesting, and unauthorized LDAP directory changes.

Affected Products

LDAP Account Manager (LAM) versions prior to 9.3
LAM deployments exposing the Profile management interface to authenticated users
Environments where LAM is used to administer LDAP directory entries

Discovery Timeline

2025-09-16 - CVE-2025-58174 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58174

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the LDAP Account Manager Profile section. LAM accepts untrusted input in the profile name field and stores it without encoding. When the profile is later rendered, the application emits the stored value directly into the HTML response. A browser then parses the injected markup and executes any embedded script content.

Exploitation requires an authenticated account with permission to create or edit profiles. Because payloads persist in the profile store, every user who subsequently views the profile executes the attacker's code. This turns a limited-privilege account into a vector for targeting administrators who routinely review profiles.

Successful execution runs in the victim's authenticated LAM session. An attacker can read session cookies where permitted, invoke authenticated LAM actions on the victim's behalf, or modify LDAP entries the victim is authorized to change.

Root Cause

The root cause is missing output encoding on the profile name field. LAM treats the stored value as trusted HTML rather than as text, violating the [CWE-79] guidance to contextually encode untrusted data before rendering. No server-side validation rejects HTML or script constructs on input.

Attack Vector

The attack requires network access to the LAM web interface and valid credentials with profile edit rights. The attacker inserts a script payload such as a <script> element into the profile name and saves the profile. Any authenticated user, including administrators, who navigates to the profile view triggers execution. User interaction is required to reach the vulnerable rendering path, which limits opportunistic exploitation but not targeted campaigns.

No verified public exploit code is available. The mechanism is described in the GitHub Security Advisory GHSA-6gqg-wm9x-5x3m.

Detection Methods for CVE-2025-58174

Indicators of Compromise

LAM profile records where the profile name field contains HTML tags, <script> elements, event handlers such as onerror= or onload=, or javascript: URIs
Unexpected outbound requests from administrator browsers to attacker-controlled domains immediately after viewing a LAM profile page
LDAP directory modifications originating from administrator sessions that correlate with profile view events in web server access logs

Detection Strategies

Review LAM configuration and profile storage for stored HTML or JavaScript payloads in profile name fields.
Inspect web server access logs for POST requests to LAM profile edit endpoints followed by GET requests where the response body contains script markup.
Correlate authenticated LAM session activity with browser telemetry to identify script execution from LAM-origin pages that deviates from baseline behavior.

Monitoring Recommendations

Enable verbose audit logging in LAM and forward events to a centralized log platform for retention and query.
Monitor LDAP directory changes for unexpected modifications made by administrator accounts shortly after LAM profile views.
Alert on Content Security Policy (CSP) violations reported by browsers accessing the LAM interface.

How to Mitigate CVE-2025-58174

Immediate Actions Required

Upgrade LDAP Account Manager to version 9.3 or later, which contains the vendor fix for CVE-2025-58174.
Audit existing profiles for HTML or JavaScript content in the profile name field and remove any suspicious entries before administrators view them.
Rotate LAM administrator credentials and invalidate active sessions if evidence of exploitation is found.
Restrict profile creation and edit permissions to a minimum set of trusted accounts.

Patch Information

The vendor released a fix in LDAP Account Manager version 9.3. Refer to the GitHub Security Advisory GHSA-6gqg-wm9x-5x3m for release details. The advisory notes no known workarounds.

Workarounds

No vendor-supplied workarounds exist. Upgrading to version 9.3 is the required remediation path.
As a defense-in-depth measure until patching, restrict access to the LAM web interface to trusted networks using firewall or reverse proxy access controls.
Deploy a strict Content Security Policy on the LAM web application to reduce the impact of inline script execution.

bash

# Example: restrict LAM access at the reverse proxy layer (nginx)
location /lam/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://lam-backend;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'";
}