CVE-2025-59518: LemonLDAP::NG RCE Vulnerability

CVE-2025-59518 Overview

CVE-2025-59518 is an operating system command injection vulnerability [CWE-78] in LemonLDAP::NG, an open-source WebSSO and identity management software. The flaw resides in the Safe jail rule evaluator, which fails to localize the _ variable during rule evaluation. An authenticated administrator with permission to edit rules evaluated by the Safe jail can execute arbitrary commands on the underlying server. The vulnerability affects LemonLDAP::NG versions before 2.16.7 and versions 2.17 through 2.21 before 2.21.3.

Critical Impact
Administrators with rule-editing privileges can break out of the Perl Safe jail sandbox and execute arbitrary OS commands on the LemonLDAP::NG server, compromising the entire SSO infrastructure.

Affected Products

LemonLDAP::NG versions before 2.16.7
LemonLDAP::NG versions 2.17 through 2.21.2
OW2 LemonLDAP::NG WebSSO and Identity Manager deployments

Discovery Timeline

2025-09-17 - CVE-2025-59518 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-59518

Vulnerability Analysis

LemonLDAP::NG uses Perl's Safe module to sandbox administrator-defined rules, expressions, and macros used in access control decisions. The Safe jail is intended to restrict what Perl code can do during evaluation, blocking access to system calls, file operations, and other dangerous operations.

The vulnerability stems from the rule evaluator failing to localize the special Perl variable $_ before evaluating administrator-supplied expressions. Without local $_, the variable retains references to outer-scope objects that exist outside the Safe compartment. An attacker can navigate from $_ to blessed objects and their associated code in the parent interpreter, escaping the sandbox and reaching unsafe operations such as system() or backtick execution.

Root Cause

The root cause is missing variable localization in the Safe jail rule evaluation code path. The Perl Safe module relies on strict compartmentalization, but unlocalized global variables provide a bridge between the trusted outer interpreter and the untrusted inner compartment. The fix introduced in commit 228d01945d48015f3f9ea8a8dc64d7e6a27750e9 properly localizes $_ so that evaluated rules cannot reach external references.

Attack Vector

Exploitation requires authenticated access with administrative privileges to modify rules evaluated by the Safe jail, such as access rules, macros, headers, or post-authentication logic. The attacker crafts a malicious Perl expression that traverses through $_ to invoke restricted built-ins, then waits for the rule to be evaluated during normal SSO request processing. Successful exploitation yields command execution under the LemonLDAP::NG service account. Refer to the GitLab Issue Discussion for additional context.

Detection Methods for CVE-2025-59518

Indicators of Compromise

Unexpected child processes spawned by the LemonLDAP::NG web service process (Apache/Nginx FastCGI workers or llng-server)
Recent modifications to LemonLDAP::NG configuration entries such as access rules, macros, or custom headers containing Perl expressions referencing $_, ref, bless, or backticks
Outbound network connections from the SSO host to attacker-controlled infrastructure following administrative configuration changes
Audit log entries showing rule edits by administrative accounts followed by anomalous service behavior

Detection Strategies

Review LemonLDAP::NG configuration history for rules containing Perl constructs that reference $_, dereference operators, or attempt to call system, exec, qx, or backticks
Monitor process trees for the web server or FastCGI worker spawning shell interpreters such as /bin/sh, bash, or perl -e
Correlate administrative authentication events in the LemonLDAP::NG manager with subsequent process execution telemetry on the host
Behavioral AI engines such as those in Singularity Endpoint can flag web service processes spawning shells, which is the primary post-exploitation signal for this command injection class

Monitoring Recommendations

Ingest LemonLDAP::NG manager audit logs and host process telemetry into a centralized data lake such as Singularity Data Lake for cross-source correlation
Alert on any modification to Safe-evaluated rules outside of approved change windows
Track service account command execution baselines and alert on deviations such as outbound curl, wget, or reverse shell patterns

How to Mitigate CVE-2025-59518

Immediate Actions Required

Upgrade LemonLDAP::NG to version 2.16.7, 2.21.3, or later depending on the deployed branch
Audit the administrator account list and remove unnecessary privileges to the manager interface
Review all existing rules, macros, and custom expressions for malicious Perl constructs before patching
Rotate secrets and credentials stored on the LemonLDAP::NG host if compromise is suspected

Patch Information

The upstream fix is available in commit 228d01945d48015f3f9ea8a8dc64d7e6a27750e9, which adds proper localization of $_ during Safe jail evaluation. See the GitLab Commit Announcement for the full patch. Administrators should apply vendor-provided packages from OW2 or their Linux distribution repositories rather than building from source where possible.

Workarounds

Restrict access to the LemonLDAP::NG manager interface to a small set of trusted administrators using network ACLs and multi-factor authentication
Implement a configuration change-review workflow that requires peer approval before any rule modification is committed
Run the LemonLDAP::NG service under a least-privileged system account with no shell and restricted filesystem access
Deploy mandatory access control policies such as AppArmor or SELinux to constrain the web service process

bash

# Verify installed LemonLDAP::NG version against fixed releases
dpkg -l | grep lemonldap-ng
# or
rpm -qa | grep lemonldap-ng

# Upgrade on Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade lemonldap-ng

# Restrict manager interface to internal admin network (Apache example)
# In /etc/apache2/sites-available/manager-apache2.conf:
# <Location />
#   Require ip 10.0.0.0/24
# </Location>