Vulnerability-Lookup

GHSA-R64V-82FH-XC63

Vulnerability from github – Published: 2025-07-09 15:30 – Updated: 2025-07-09 15:30

Summary

Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization

Details

Impact

Any user with a Juju account on a controller can read debug log messages from the /log endpoint. No specific permissions are required - it's just sufficient for the user to exist in the controller user database. The log messages may contain sensitive information.

Details

The /log endpoint is accessible at the following endpoints: - wss://<controller-ip>/log - wss://<controller-ip>/model/<model-uuid>/log

In order to connect to these endpoints, the client must pass an X-Juju-Client-Version header that matches the current version and pass credentials in a Basic Authorization header. Once connected, the service will stream log events even though the user is not authorised to view them.

To reproduce:

juju bootstrap
juju add-user testuser
juju change-user-password testuser

Run the wscat command below to connect to wss://<controller-ip>:17070/api. Update the JSON payload to include the username and password that were created above.

wscat --no-check -c wss://contorller-ip:17070/model/modelUUID/api
{ "type": "Admin", "request": "Login", "version": 3, "params": { "client-
version": "3.6.1.0", "auth-tag": "user-testuser", "credentials": "
password" } }

Observe that the connection fails due to a lack of permissions.

Run the command below to connect to the log endpoint. Note that the credentials are passed in the --auth flag.

wscat --auth user-testuser:password -H "X-Juju-ClientVersion: 3.6.4" --no-check -c wss://<controller-ip>:17070/log

Observe that the logs are returned in the server’s response.

Code

The /log handlers are registered here https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L867 https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L980

And the only auth required is that the incoming request be for an authenticated user

https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L713

but no specific permission checks are done.

Workarounds

There are no workarounds.

References

F-01

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/juju/juju"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20250619024904-402ff008dcc2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-53512"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-09T15:30:58Z",
    "nvd_published_at": "2025-07-08T17:16:04Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nAny user with a Juju account on a controller can read debug log messages from the `/log` endpoint.\nNo specific permissions are required - it\u0027s just sufficient for the user to exist in the controller user database.\nThe log messages may contain sensitive information.\n\n### Details\n\nThe `/log` endpoint is accessible at the following endpoints:\n- `wss://\u003ccontroller-ip\u003e/log`\n- `wss://\u003ccontroller-ip\u003e/model/\u003cmodel-uuid\u003e/log`\n\nIn order to connect to these endpoints, the client must pass an X-Juju-Client-Version header that matches the current version and pass credentials in a Basic Authorization header. Once connected, the service will stream log events even though the user is not authorised to view them.\n\nTo reproduce:\n\n```\njuju bootstrap\njuju add-user testuser\njuju change-user-password testuser\n```\nRun the [wscat](https://github.com/websockets/wscat) command below to\nconnect to `wss://\u003ccontroller-ip\u003e:17070/api`. Update the JSON payload to include the username and password that were created above.\n\n```\nwscat --no-check -c wss://contorller-ip:17070/model/modelUUID/api\n{ \"type\": \"Admin\", \"request\": \"Login\", \"version\": 3, \"params\": { \"client-\nversion\": \"3.6.1.0\", \"auth-tag\": \"user-testuser\", \"credentials\": \"\npassword\" } }\n```\n\nObserve that the connection fails due to a lack of permissions.\n\nRun the command below to connect to the log endpoint. Note that the credentials are passed in the --auth flag.\n\n```\nwscat --auth user-testuser:password -H \"X-Juju-ClientVersion: 3.6.4\" --no-check -c wss://\u003ccontroller-ip\u003e:17070/log\n```\n\nObserve that the logs are returned in the server\u2019s response.\n\n### Code\n\nThe `/log` handlers are registered here\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L867\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L980\n\nAnd the only auth required is that the incoming request be for an authenticated user\n\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L713\n\nbut no specific permission checks are done.\n\n### Workarounds\nThere are no workarounds.\n\n### References\n[F-01](https://drive.google.com/file/d/1pHRNiaA8LyMVJYwIyTqelsqJ9FmImDf0/view)",
  "id": "GHSA-r64v-82fh-xc63",
  "modified": "2025-07-09T15:30:59Z",
  "published": "2025-07-09T15:30:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/juju/juju/security/advisories/GHSA-r64v-82fh-xc63"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53512"
    },
    {
      "type": "WEB",
      "url": "https://github.com/juju/juju/commit/402ff008dcc2cb57f4441968628637efb5c2a662"
    },
    {
      "type": "WEB",
      "url": "https://github.com/juju/juju/commit/c91a1f4046956874ba77c8b398aecee3d61a2dc3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/juju/juju"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization"
}

CVE-2025-53512 (GCVE-0-2025-53512)

Vulnerability from cvelistv5 – Published: 2025-07-08 16:47 – Updated: 2025-07-08 19:09

Title

Sensitive log retrieval in Juju

Summary

The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-08 19:09 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-285 - Improper Authentication

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://github.com/juju/juju/security/advisories/…

Impacted products

1 product

Vendor	Product	Version
Canonical	Juju	Affected: 2.0.0 , < 2.9.52 (semver) Affected: 3.0.0 , < 3.6.8 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53512",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-08T19:09:11.652417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-08T19:09:24.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://juju.is/",
          "defaultStatus": "unaffected",
          "packageName": "juju",
          "platforms": [
            "Linux"
          ],
          "product": "Juju",
          "repo": "https://github.com/juju/juju",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "2.9.52",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.8",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The /log endpoint on a Juju controller lacked sufficient authorization checks, allowing unauthorized users to access debug messages that could contain sensitive information."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Any user with a Juju account on a controller could read debug log messages from the /log endpoint."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-08T16:47:44.427Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "url": "https://github.com/juju/juju/security/advisories/GHSA-r64v-82fh-xc63"
        }
      ],
      "source": {
        "advisory": "https://github.com/juju/juju/security/advisories/GHSA-r64v-82fh-xc63",
        "discovery": "INTERNAL"
      },
      "title": "Sensitive log retrieval in Juju"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2025-53512",
    "datePublished": "2025-07-08T16:47:44.427Z",
    "dateReserved": "2025-07-02T08:52:42.036Z",
    "dateUpdated": "2025-07-08T19:09:24.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-R64V-82FH-XC63

Impact

Details

Code

Workarounds

References

CVE-2025-53512 (GCVE-0-2025-53512)

Tags

Sightings

Nomenclature

Related by attack behaviour