Listen to this Post
This vulnerability exists in Juju’s cross-model relation authorization logic when handling macaroons. When a controller receives a macaroon for authorization but lacks the corresponding root key to verify its integrity (e.g., after a model migration or due to an expired macaroon), it fails the initial verification. However, the flawed process then extracts the “declared caveats” (permission statements) from this unvalidated, untrusted macaroon. It blindly accepts the facts within these caveats, such as “user X has access to offer Y,” as truth. The system subsequently uses these unverified facts to mint a completely new, cryptographically valid macaroon. This newly minted macaroon grants the permissions originally claimed by the unverified source, effectively allowing an attacker to forge authorization credentials by presenting a crafted, unverifiable macaroon.
Platform: Juju
Version: Affected versions
Vulnerability: Authorization Bypass
Severity: Critical
date: 2023
Prediction: No patch
What Undercode Say:
Simulating macaroon creation with a caveat ./charm-build --relation-offer <offer_name> --attached-macaroon ./forged.macaroon Attempting to use a macaroon from an unknown/unmigrated model juju consume admin/controller.model-name --via ./unverified.macaroon Checking for discharge endpoints without auth (potential indicator) juju debug-log --include macaroon --level WARNING | grep "discharge"
How Exploit:
An attacker crafts a macaroon declaring false caveats (e.g., user access rights). They send this macaroon to a controller missing the root key. The controller, failing to verify the signature, extracts the attacker’s declared caveats. It mints a new, valid discharge macaroon based on those false claims. The attacker uses this new, valid macaroon to authenticate and consume a cross-model offer, impersonating the user named in the caveat.
Protection from this CVE
Ensure model migrations correctly transfer all macaroon root keys. Implement strict validation; reject any macaroon that cannot be fully verified. Require authentication on all discharge endpoints. Scope root keys explicitly to models.
Impact:
Unauthorized cross-model access. Privilege escalation. Data exfiltration across models.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
