AI analysis
Lemonldap::NG::Handler, the Perl reverse-proxy authentication component of the Lemonldap::NG SSO suite, evaluates each vhost's locationRules regular expressions against REQUEST_URI (the raw, still-encoded request line) while the backend web server routes on the percent-decoded and normalized path. An attacker triggers the flaw by spelling a protected URL in an equivalent form — percent-encoding a path character, inserting dot segments, or doubling a slash — so that no locationRules regexp matches and the vhost's default rule decides access. This bypasses deny rules, identity and group conditions, and unprotect and skip rules alike, letting an authenticated user reach any URL a rule was meant to restrict; the gain is capped at whatever the vhost's default rule already grants, so only vhosts with a default rule more permissive than their other rules are affected. All maintained branches are impacted, with fixes in 2.16.10, 2.21.6, and 2.23.4. No public proof of concept exists, the flaw is not in the CISA KEV catalog, and no exploitation has been reported.
What to do: Upgrade to 2.16.10, 2.21.6, or 2.23.4 depending on your branch. Until patched, make each affected vhost's default rule deny (or at least as strict as its most restrictive rule) so unmatched URI spellings cannot inherit permissive access. Review handler and web-server logs for authenticated requests containing unexpected percent-encoding, dot segments, or doubled slashes targeting locations covered by restrictive rules.
Affected
| Lemonldap::NG::Handler (Perl) | >= 2.0.0, < 2.16.10 |
| Lemonldap::NG::Handler (Perl) | >= 2.17.0, < 2.21.6 |
| Lemonldap::NG::Handler (Perl) | >= 2.22.0, < 2.23.4 |
Estimated exposure
moderateHundreds to low thousands of self-hosted deployments (order of magnitude ~1,000 installations), collectively protecting an order of 100,000+ users — Lemonldap::NG is self-hosted open-source IAM software with no install telemetry, deployed mainly by European (especially French) public-sector, education, and enterprise organizations; internet scans typically surface only a few hundred…
Description
Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike. Only a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.