Vulnerability feed

Executive summary

A missing authorization check in the unit resources download route of Canonical Juju 4.0 through 4.0.15 lets any user who can log in to the controller, or a unit agent acting for another unit, download a unit's resource. The advisory does not state a severity score. The advisory does not state a vendor recommendation or a fixed version; the attached change restricts the route to unit and application agents and checks that the unit in the URL matches the caller.

Technical summary

The flaw is a missing authorization check, classed in the advisory as CWE-style missing authorization, in the GET /model/:modeluuid/units/:unit/resources/:resource route. The route was registered with an always-allow authorizer and its opener getter dropped the tag kinds, so any authenticated controller principal, including a user with only login access, could stream a resource and have SetUnitResource recorded against the named unit. Exploitation needs only valid controller credentials and knowledge of a unit name in the model. The discussion describes a fix that limits the route to unit and application agents and binds the URL unit to the authenticated agent, but the fixed Juju version is not stated in the advisory. No workaround is stated, no CVSS score is stated, and no exploitation in the wild is stated. Detection guidance is not stated as such, although the discussion includes curl test requests that return 403 after the fix.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/juju/juju/pull/23360

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Attack requirements

None

Privileges required

Low

User interaction

None

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affects

CanonicalCanonical Juju