A critical OS command injection vulnerability in LemonLDAP::NG allows authorized administrators to achieve arbitrary code execution on the underlying server.

This vulnerability is a CWE-78 OS Command Injection flaw occurring within the Safe jail. It arises because the system fails to properly localize variables during rule evaluation, enabling an authenticated administrator with rule-editing privileges to inject and execute OS commands.

The ability to execute arbitrary OS commands on the server provides an attacker with full control over the application environment. Given the high CVSS score of 8.0, this represents a significant risk of total system compromise, potential data exfiltration, and lateral movement within the network.

Immediate Action: Upgrade LemonLDAP::NG to version 2.16.7 or 2.21.3 or higher to apply the necessary patches for the Safe jail component.

Proactive Monitoring: Review administrative audit logs for suspicious rule modifications or unexpected process execution patterns originating from the web server user.

Compensating Controls: Restrict administrative access to the configuration interface to the minimum number of trusted personnel and implement strict network segmentation to limit the reach of a compromised server.

Public Exploit Available: Unknown.

This vulnerability presents a severe risk due to the potential for full server compromise. Security teams should prioritize the update to the patched versions of LemonLDAP::NG immediately. Administrators must ensure that configuration management and rule-editing capabilities are strictly governed to prevent exploitation by unauthorized or compromised accounts.