Skip to content
Log inStart free trial

GHSA-r64v-82fh-xc63 CVE-2025-53512 GO-2025-3806

Juju vulnerable to sensitive log retrieval via authenticated endpoint without authorization

Medium Go
Severity
6.5 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.38%
Chance of exploitation in the next 30 days. Higher than 31.80% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Fix
0.0.0-20250619024904-402ff008dcc2
Upgrade github.com/juju/juju to this version or later

Description

Impact

Any user with a Juju account on a controller can read debug log messages from the /log endpoint. No specific permissions are required - it's just sufficient for the user to exist in the controller user database. The log messages may contain sensitive information.

Details

The /log endpoint is accessible at the following endpoints:

  • wss://<controller-ip>/log
  • wss://<controller-ip>/model/<model-uuid>/log

In order to connect to these endpoints, the client must pass an X-Juju-Client-Version header that matches the current version and pass credentials in a Basic Authorization header. Once connected, the service will stream log events even though the user is not authorised to view them.

To reproduce:

juju bootstrap
juju add-user testuser
juju change-user-password testuser

Run the wscat command below to connect to wss://<controller-ip>:17070/api. Update the JSON payload to include the username and password that were created above.

wscat --no-check -c wss://contorller-ip:17070/model/modelUUID/api
{ "type": "Admin", "request": "Login", "version": 3, "params": { "client-
version": "3.6.1.0", "auth-tag": "user-testuser", "credentials": "
password" } }

Observe that the connection fails due to a lack of permissions.

Run the command below to connect to the log endpoint. Note that the credentials are passed in the --auth flag.

wscat --auth user-testuser:password -H "X-Juju-ClientVersion: 3.6.4" --no-check -c wss://<controller-ip>:17070/log

Observe that the logs are returned in the server’s response.

Code

The /log handlers are registered here https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L867 https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L980

And the only auth required is that the incoming request be for an authenticated user

https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L713

but no specific permission checks are done.

Workarounds

There are no workarounds.

References

F-01

Affected versions

Go

PackageVulnerableFixed in
github.com/juju/juju
< 0.0.0-20250619024904-402ff008dcc2
0.0.0-20250619024904-402ff008dcc2

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/juju/juju Go → 0.0.0-20250619024904-402ff008dcc2

go
go get github.com/juju/juju@v0.0.0-20250619024904-402ff008dcc2 && go mod tidy

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it
  • Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-7m55-2hr4-pw78
Juju: In-Memory Token Store for Discharge Tokens Lacks Concurrency Safety and Persistence
Medium Also affects github.com/juju/juju
GHSA-w5fq-8965-c969
Juju: CloudSpec method leaking cloud credentials
Medium Also affects github.com/juju/juju
GHSA-245v-p8fj-vwm2
Juju has a resource poisoning vulnerability
Medium Also affects github.com/juju/juju
GHSA-j6f6-jp3p-53mw
Juju: Read All Controller Logs From Compromised Workload
Medium Also affects github.com/juju/juju
GHSA-gvrj-cjch-728p
Juju has Improper TLS Client/Server authentication and certificate verification on Database Cluster
Critical Also affects github.com/juju/juju
GHSA-5cj2-rqqf-hx9p
Juju affected by Confused Deputy IDOR attack via Predictable user specified ID in Juju Secrets
Medium Also affects github.com/juju/juju
GHSA-439w-v2p7-pggc
Juju has unauthorized access to out-of-scope Kubernetes secrets
High Also affects github.com/juju/juju
GHSA-89x7-5m5m-mcmm
Juju has unauthorized update of out-of-scope Vault secrets
Medium Also affects github.com/juju/juju
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor