CVE-2025-8791
📋 TL;DR
This critical vulnerability in LitmusChaos Litmus allows attackers to bypass authorization controls by manipulating the 'role' parameter in the /auth/list_projects endpoint. Remote attackers can potentially access unauthorized project data or perform unauthorized actions. All LitmusChaos deployments up to version 3.19.0 are affected.
💻 Affected Systems
- LitmusChaos Litmus
📦 What is this software?
Litmus by Litmuschaos
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the LitmusChaos environment allowing unauthorized access to all projects, potential privilege escalation, and manipulation of chaos experiments across the entire infrastructure.
Likely Case
Unauthorized access to sensitive project data, exposure of chaos experiment configurations, and potential lateral movement within the Kubernetes environment where LitmusChaos is deployed.
If Mitigated
Limited exposure of non-critical project metadata if proper network segmentation and authentication controls are implemented.
🎯 Exploit Status
Exploit details have been publicly disclosed but no proof-of-concept code is available. Attackers need some level of access to the system to manipulate the role parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.20.0 or later
Vendor Advisory: https://github.com/litmuschaos/litmus
Restart Required: Yes
Instructions:
1. Update LitmusChaos to version 3.20.0 or later. 2. Restart all LitmusChaos components. 3. Verify the fix by testing authorization controls on the /auth/list_projects endpoint.
🔧 Temporary Workarounds
Network Access Restriction
kubernetesRestrict network access to the LitmusChaos API endpoints to only trusted sources
# Use Kubernetes NetworkPolicy or firewall rules to restrict access
kubectl apply -f network-policy.yaml
API Gateway Protection
allImplement an API gateway or reverse proxy with additional authorization checks
# Configure nginx or similar proxy with additional auth checks
location /auth/list_projects {
proxy_pass http://litmus-backend;
auth_request /validate-auth;
}
🧯 If You Can't Patch
- Implement strict network segmentation to isolate LitmusChaos from untrusted networks
- Deploy Web Application Firewall (WAF) rules to block suspicious requests to /auth/list_projects endpoint
🔍 How to Verify
Check if Vulnerable:
Check if your LitmusChaos version is 3.19.0 or earlier by examining the deployment configuration or running 'kubectl get pods -n litmus -o jsonpath="{.items[*].spec.containers[*].image}"'Check Version:
kubectl get pods -n litmus -o jsonpath="{.items[*].spec.containers[*].image}" | grep -o 'litmuschaos/litmus:[0-9.]*'Verify Fix Applied:
After updating, test the /auth/list_projects endpoint with different role parameters to ensure proper authorization is enforced📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to /auth/list_projects endpoint
- Multiple failed authorization attempts followed by successful access
- Requests with manipulated role parameters
Network Indicators:
- Unusual traffic patterns to the LitmusChaos API
- Requests to /auth/list_projects with unexpected role values
SIEM Query:
source="litmus-logs" AND (uri_path="/auth/list_projects" AND (role!="expected_role" OR role_parameter_changed=true))