Description

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restrict it. The handler matches each vhost's locationRules regular expressions against REQUEST_URI, the raw request line, while the web server routes on the path it has already percent-decoded and normalized. A request that percent-encodes a character of the path, inserts dot segments, or doubles a slash therefore reaches the protected resource under a URI that no rule regexp matches, and the vhost's default rule decides access. Deny rules, identity and group conditions, and unprotect and skip rules are bypassed alike. Only a vhost whose default rule is more permissive than its other rules is affected. An authenticated user then reaches any URL a locationRules regexp was meant to restrict, but gains no more than that default rule already grants.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-25T02:16:54.677Z",
  "pubdate": "2026-09-25T02:16:54.677Z",
  "executiveSummary": "Lemonldap::NG::Handler is susceptible to a path normalization vulnerability allowing attackers to bypass configured locationRules. This issue arises due to a discrepancy between how the web server processes request paths and how the handler evaluates them against access control regular expressions. By utilizing non-normalized URI components, such as redundant slashes, dot segments, or percent-encoded characters, an attacker can ensure that a request does not match specific restrictive rules.\nThe impact is limited to vhost configurations where the default rule is less restrictive than the targeted locationRules. In such cases, the security policy is bypassed, and the request falls through to the default handler behavior. This vulnerability affects multiple versions across the 2.0.x, 2.17.x, 2.22.x, and 2.23.x branches. While an attacker must have network access to reach the protected resource, the bypass allows authenticated users to access restricted paths that they would otherwise be blocked from by specific rule definitions. This does not grant administrative access but represents a failure in granular access control enforcement.",
  "technicalDetails": "The vulnerability resides within the Lemonldap::NG::Handler component, which is responsible for enforcing security policies against incoming HTTP requests based on configured locationRules. The root cause is a canonicalization mismatch between the web server's routing logic and the handler's access control matching mechanism. The web server performs percent-decoding and path normalization before routing the request to the target resource; however, the Lemonldap::NG::Handler matches its locationRules regular expressions against the raw REQUEST_URI string provided by the web server environment.\nBecause the raw REQUEST_URI is not normalized prior to evaluation, an attacker can craft a request that represents the same underlying path as a restricted resource but uses alternative formatting that fails to trigger the intended regular expression match. Examples of such evasion techniques include path traversal patterns (e.g., using '/./'), URL-encoded characters (e.g., '%2f' for '/'), or the insertion of redundant slashes (e.g., '//').\nWhen a request with these non-normalized features is sent, the web server successfully normalizes the path to the protected resource, but the Lemonldap::NG::Handler fails to find a matching regular expression rule because the pattern is looking for the standard, normalized structure. Consequently, the handler skips the specific security rules (such as Deny rules, identity/group-based conditions, or specific Unprotect/Skip directives) and falls through to the vhost's default access rule. The impact is dictated by the vhost configuration; if the default rule is explicitly or implicitly more permissive than the intended granular rules, the bypass is successful.\nAffected versions include 2.0.0 through 2.16.9, 2.17.0 through 2.21.5, and 2.22.0 through 2.23.3. This vulnerability requires the attacker to be able to reach the web server environment, and for the target resource to be protected by a rule more restrictive than the default vhost rule. Post-exploitation, the attacker gains access to restricted endpoints that were intended to be shielded by locationRules, potentially leading to unauthorized information disclosure or interaction with functions that rely on those specific restrictive rules for security."
}