Juju Controller Arbitrary Executable Upload via Authenticated Endpoint Without Authorization

Critical Vulnerability Information Vulnerability Title Arbitrary executable upload via authenticated endpoint without authorization Affected Versions Affected versions: =3.0.6 Fixed versions: 2.9.5, 3.0.6 Vulnerability Description An attacker can exploit this vulnerability by installing an agent binary in the Juju controller without possessing any model or permissions. Only a simple user account with controller access is required. Vulnerability Details The upload handler only checks whether the request to upload an agent binary originates from a controller machine. Administrative operations (such as upgrades or migrations) copy the binary to all models and controller machines. Attackers can leverage this vulnerability to gain persistent access to affected models or controllers. Vulnerability Code Snippets Upload handler definition: https://github.com/juju/juju/blob/3.0/src/server/server.go#L766-L767 Authentication check: https://github.com/juju/juju/blob/3.0/src/api/base/apihttpcontext.go#L101 Controller registration: https://github.com/juju/juju/blob/3.0/src/api/uniter/hookcontext_test.go#L280-L284 Exploitation Steps 1. Create a new controller. 2. Add a user with no permissions. 3. Use the command to view registration strings. 4. Retrieve sensitive credentials and information. 5. Log in to the controller using a new password. 6. Apply patches and build changes. 7. Verify that the controller agent binary has been tampered with. Impact This vulnerability allows an unprivileged user to eventually compromise the entire Juju controller and gain access to all infrastructure and secrets. Through model migration, it may also affect other controllers.

Goal Reached Thanks to every supporter — we hit 100%!

Juju Controller Arbitrary Executable Upload via Authenticated Endpoint Without Authorization

More from this source