CVE-2025-0928

In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/juju/juju/security/advisories/GHSA-4vc8-wvhw-m5gv	Vendor Advisory Exploit

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:canonical:juju::::::go::*
	cpe:2.3:a:canonical:juju::::::go::*

History

26 Aug 2025, 17:54

Type	Values Removed	Values Added
CPE		cpe:2.3:a:canonical:juju::::::go::*
References	~~() https://github.com/juju/juju/security/advisories/GHSA-4vc8-wvhw-m5gv -~~	() https://github.com/juju/juju/security/advisories/GHSA-4vc8-wvhw-m5gv - Vendor Advisory, Exploit
CWE		CWE-434
First Time		Canonical Canonical juju

10 Jul 2025, 13:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-08 18:15

Updated : 2025-08-26 17:54

NVD link : CVE-2025-0928

Mitre link : CVE-2025-0928

CVE.ORG link : CVE-2025-0928

JSON object : View

Products Affected

canonical

juju

CWE

CWE-285

Improper Authorization

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2025-0928", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2025-07-08T18:15:26.767", "references": [{"url": "https://github.com/juju/juju/security/advisories/GHSA-4vc8-wvhw-m5gv", "tags": ["Vendor Advisory", "Exploit"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-285"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "In Juju versions prior to 3.6.8 and 2.9.52, any authenticated controller user was allowed to upload arbitrary agent binaries to any model or to the controller itself, without verifying model membership or requiring explicit permissions. This enabled the distribution of poisoned binaries to new or upgraded machines, potentially resulting in remote code execution."}, {"lang": "es", "value": "En versiones de Juju anteriores a la 3.6.8 y la 2.9.52, cualquier usuario autenticado del controlador pod\u00eda cargar binarios arbitrarios del agente en cualquier modelo o en el propio controlador, sin verificar la pertenencia al modelo ni requerir permisos expl\u00edcitos. Esto permit\u00eda la distribuci\u00f3n de binarios envenenados a equipos nuevos o actualizados, lo que pod\u00eda provocar la ejecuci\u00f3n remota de c\u00f3digo."}], "lastModified": "2025-08-26T17:54:53.650", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "7CD38943-146D-43E1-9BB9-D7317A914896", "versionEndExcluding": "2.9.52"}, {"criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "8220B8DE-A1D6-4D66-AFD4-830B96E8D7E1", "versionEndExcluding": "3.6.8", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}