1 line
3.5 KiB
JSON
1 line
3.5 KiB
JSON
{"schema_version":"1.9.0","id":"GHSA-r64v-82fh-xc63","published":"2025-07-09T15:30:58Z","modified":"2025-07-28T20:42:15.788089Z","aliases":["CVE-2025-53512","GO-2025-3806"],"summary":"Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization","details":"### Impact\nAny user with a Juju account on a controller can read debug log messages from the `/log` endpoint.\nNo specific permissions are required - it's just sufficient for the user to exist in the controller user database.\nThe log messages may contain sensitive information.\n\n### Details\n\nThe `/log` endpoint is accessible at the following endpoints:\n- `wss://<controller-ip>/log`\n- `wss://<controller-ip>/model/<model-uuid>/log`\n\nIn order to connect to these endpoints, the client must pass an X-Juju-Client-Version header that matches the current version and pass credentials in a Basic Authorization header. Once connected, the service will stream log events even though the user is not authorised to view them.\n\nTo reproduce:\n\n```\njuju bootstrap\njuju add-user testuser\njuju change-user-password testuser\n```\nRun the [wscat](https://github.com/websockets/wscat) command below to\nconnect to `wss://<controller-ip>:17070/api`. Update the JSON payload to include the username and password that were created above.\n\n```\nwscat --no-check -c wss://contorller-ip:17070/model/modelUUID/api\n{ \"type\": \"Admin\", \"request\": \"Login\", \"version\": 3, \"params\": { \"client-\nversion\": \"3.6.1.0\", \"auth-tag\": \"user-testuser\", \"credentials\": \"\npassword\" } }\n```\n\nObserve that the connection fails due to a lack of permissions.\n\nRun the command below to connect to the log endpoint. Note that the credentials are passed in the --auth flag.\n\n```\nwscat --auth user-testuser:password -H \"X-Juju-ClientVersion: 3.6.4\" --no-check -c wss://<controller-ip>:17070/log\n```\n\nObserve that the logs are returned in the server’s response.\n\n### Code\n\nThe `/log` handlers are registered here\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L867\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L980\n\nAnd the only auth required is that the incoming request be for an authenticated user\n\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L713\n\nbut no specific permission checks are done.\n\n### Workarounds\nThere are no workarounds.\n\n### References\n[F-01](https://drive.google.com/file/d/1pHRNiaA8LyMVJYwIyTqelsqJ9FmImDf0/view)","affected":[{"package":{"name":"github.com/juju/juju","ecosystem":"Go","purl":"pkg:golang/github.com/juju/juju"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20250619024904-402ff008dcc2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-r64v-82fh-xc63/GHSA-r64v-82fh-xc63.json"}}],"references":[{"type":"WEB","url":"https://github.com/juju/juju/security/advisories/GHSA-r64v-82fh-xc63"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53512"},{"type":"WEB","url":"https://github.com/juju/juju/commit/402ff008dcc2cb57f4441968628637efb5c2a662"},{"type":"WEB","url":"https://github.com/juju/juju/commit/c91a1f4046956874ba77c8b398aecee3d61a2dc3"},{"type":"PACKAGE","url":"https://github.com/juju/juju"}],"database_specific":{"cwe_ids":["CWE-200"],"github_reviewed":true,"github_reviewed_at":"2025-07-09T15:30:58Z","nvd_published_at":"2025-07-08T17:16:04Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}]} |