CVE-2025-54882
📋 TL;DR
Himmelblau versions 0.8.0-0.9.21 and 1.0.0-beta-1.1.0 store Kerberos credential caches with world-readable permissions, allowing any local user to access sensitive authentication tokens. This affects organizations using Himmelblau for Azure Entra ID and Intune interoperability. Attackers could potentially steal credentials and impersonate users or services.
💻 Affected Systems
- Himmelblau
📦 What is this software?
Himmelblau by Himmelblau Idm
Himmelblau by Himmelblau Idm
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to Kerberos Ticket Granting Tickets (TGTs), enabling them to impersonate users, access Azure/Intune resources, and potentially escalate privileges across the hybrid cloud environment.
Likely Case
Local attackers or malicious users on the same system read cached credentials and use them for unauthorized access to Azure/Intune-managed resources.
If Mitigated
With proper file permissions, only authorized users can access credential caches, preventing credential theft even if other vulnerabilities exist.
🎯 Exploit Status
Exploitation requires local access to read world-readable files. No authentication bypass needed if attacker has local user access. The advisory provides clear details about the vulnerable file locations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.9.22 or 1.2.0
Vendor Advisory: https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83
Restart Required: Yes
Instructions:
1. Stop Himmelblau services. 2. Backup configuration and data. 3. Upgrade to version 0.9.22 (for 0.x branch) or 1.2.0 (for 1.x branch). 4. Restart Himmelblau services. 5. Verify proper file permissions on credential cache directories.
🔧 Temporary Workarounds
Restrict cache file permissions
linuxRemove world-readable permissions from Himmelblau credential cache files and directories
chmod 600 /path/to/himmelblau/cache/*
chmod 700 /path/to/himmelblau/cache/
Windows ACL restriction
windowsRemove read access for non-owners on Himmelblau cache directories
icacls "C:\ProgramData\Himmelblau\cache" /remove:g "Users"
icacls "C:\ProgramData\Himmelblau\cache" /inheritance:r
🧯 If You Can't Patch
- Apply the workaround to restrict file permissions on all Himmelblau cache directories
- Implement strict access controls to limit who can log into the Himmelblau host system
🔍 How to Verify
Check if Vulnerable:
Check Himmelblau version and examine file permissions on cache directories: ls -la /path/to/himmelblau/cache/Check Version:
himmelblau --version or check package managerVerify Fix Applied:
Verify version is 0.9.22+ or 1.2.0+ and cache files have restricted permissions (600 for files, 700 for directories)📡 Detection & Monitoring
Log Indicators:
- Failed permission checks on cache files
- Unexpected access to credential cache directories
Network Indicators:
- Unusual authentication patterns from Himmelblau host
- Multiple failed then successful Azure/Intune authentications
SIEM Query:
source="himmelblau" AND (event="permission_denied" OR event="cache_access")🔗 References
- https://github.com/himmelblau-idm/himmelblau/commit/b562053df3dffb1dd9ab3d09af986886773be2ad
- https://github.com/himmelblau-idm/himmelblau/commit/faae58b0384aca8b21b4be5f1c507412eec3778a
- https://github.com/himmelblau-idm/himmelblau/releases/tag/0.9.22
- https://github.com/himmelblau-idm/himmelblau/releases/tag/1.2.0
- https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83
- https://github.com/himmelblau-idm/himmelblau/security/advisories/GHSA-phfx-rjfw-wj83
