CVE-2024-7558 JUJU_CONTEXT_ID is a predictable authentication secret

High 8.7 Published 2 Oct 2024 Updated 2 Oct 2024

An unprivileged user can guess a predictable authentication secret to access Juju charm tools and information, leading to privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2024-7558?

CVE-2024-7558 is a high-severity vulnerability in Canonical Ltd. Juju, published on 2 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.

Weakness: CWE-335, CWE-330, CWE-340, CWE-337, CWE-1391

Which versions are affected by CVE-2024-7558?

3 open source packages ship an affected version, including github.com/juju/juju. It affects 1 product.

Package	Affected	Fixed in
`github.com/juju/juju` Go	All versions	`0.0.0-20240826044107-ecd7e2d0e986`
`github.com/juju/juju` Go	All versions	`0.0.0-20240826044107-ecd7e2d0e986`
`github.com/juju/juju` Go	All versions	`0.0.0-20240826044107-ecd7e2d0e986`

Products include Canonical Juju.

How do I fix CVE-2024-7558?

Upgrade github.com/juju/juju to 0.0.0-20240826044107-ecd7e2d0e986 or later.

Is CVE-2024-7558 being exploited?

There is no known exploitation of CVE-2024-7558 in the wild and no public exploit code.

Sources

Also known as GHSA-mh98-763h-m9v4, GO-2024-3173.