Arbitrary file reading vulnerability

[yhy]

When I learned codeql, I found that there was a potential loophole in juju. When the authentication passed, I downloaded the backup file. I could control the id value to any file location, and then download the file through download().

The version affected by the vulnerability is the latest version 3.0 and below(juju<=latest version)
Please see the attachment for details.

[Ian Booth (wallyworld)]

Thank you for raising this issue.

[Harry Pidcock (hpidcock)]

Tracking @ https://github.com/juju/juju/security/advisories/GHSA-x5rv-w9pm-8qp8

The issue was introduced in 2.9.22 via this commit https://github.com/juju/juju/commit/05de4b980f6fbf0884c8c774df66a02bd2498cbb

It allows a user with read access to the controller to read arbitrary files from disk.

Before 2.9.22 the backup ID which is used to read from disk, had validation to ensure the file path contained `juju-backup.tar.gz` and would otherwise fetch the backup from gridfs in mongodb if the ID did not.

Now it allows the user to pass an `ID` unvalidated to `os.Open`, sending the file contents back to the requester.

[Ian Booth (wallyworld)]

https://github.com/juju/juju/pull/15006

[yhy (yhy0)]

That's great. The repair speed is very fast. Could you apply for a cve for me if you can? The organization is moresec/yhy

[Ian Booth (wallyworld)]

I can see https://github.com/moresec
Is that correct?

[yhy (yhy0)]

no , I work at https://moresec.cn/ and my github url is https://github.com/yhy0

[yhy (yhy0)]

I haven't received the CVE yet. Is that a failure?

[Ian Booth (wallyworld)]

You've been added but we're not publishing it till the fix is released :-)

[Seth Arnold (seth-arnold)]

Hello Ian, yhy,

Please use CVE-2023-0092 for this issue.

Does this attack vector require an authenticated user?
What model, controller, or cloud access settings are required to allow this attack to succeed?
What model, controller, or cloud access settings mean the user has code execution privileges?

Does https://github.com/juju/juju/pull/15006 handle this case:
juju download-backup /var/snap/juju-db/common/backups/../../../../../etc/passwd

I'd love to see some tests added for this and relative paths.

Thanks

[Harry Pidcock (hpidcock)]

Juju 2.9.38 is in QA now. Still waiting on Juju 3.0.3 before making this public.

Seth, I'll have some specific tests this week.

Does this attack vector require an authenticated user?
Yes.

What model, controller, or cloud access settings are required to allow this attack to succeed?
User with read access on the controller.

What model, controller, or cloud access settings mean the user has code execution privileges?
Depends on the information read, effectively could read a private ssh key or /etc/shadow and possibly gain access that way.

[Ian Booth (wallyworld)]

@seth

$ juju download-backup /var/snap/juju-db/common/backups/../../../../../etc/passwd
ERROR Get https://10.105.74.65:17070/model/8cfc8b19-cb52-42ef-8923-345bef8dc145/backups: backup file "/var/snap/juju-db/common/backups/../../../../../etc/passwd" not valid