CVE-2025-8793
📋 TL;DR
This vulnerability in LitmusChaos Litmus allows attackers to manipulate resource identifiers via the projectID argument, potentially leading to unauthorized access or resource manipulation. It affects LitmusChaos Litmus up to version 3.19.0. The vulnerability can be exploited remotely and has been publicly disclosed.
💻 Affected Systems
- LitmusChaos Litmus
📦 What is this software?
Litmus by Litmuschaos
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to sensitive project data, resource manipulation, or privilege escalation within the LitmusChaos environment.
Likely Case
Unauthorized viewing or modification of project resources, potentially disrupting chaos engineering experiments.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially only affecting non-critical resources.
🎯 Exploit Status
Exploit details have been publicly disclosed but no proof-of-concept code is confirmed. Attack requires understanding of LitmusChaos project structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.20.0 or later (assumed - check vendor documentation)
Vendor Advisory: Not provided in references
Restart Required: No
Instructions:
1. Check current LitmusChaos version. 2. Upgrade to version 3.20.0 or later. 3. Verify the fix by testing projectID functionality.
🔧 Temporary Workarounds
Restrict network access
allLimit access to LitmusChaos API endpoints to trusted networks only
Use network firewall rules or Kubernetes NetworkPolicies to restrict access
Implement API authentication
allEnsure strong authentication is required for all API calls
Configure LitmusChaos authentication settings appropriately
🧯 If You Can't Patch
- Implement strict network segmentation to isolate LitmusChaos from untrusted networks
- Monitor API logs for unusual projectID manipulation attempts
🔍 How to Verify
Check if Vulnerable:
Check if running LitmusChaos version 3.19.0 or earlierCheck Version:
kubectl get deployment -n litmus | grep litmusVerify Fix Applied:
Verify installation of version 3.20.0 or later and test projectID functionality📡 Detection & Monitoring
Log Indicators:
- Unusual projectID values in API requests
- Failed authentication attempts with projectID manipulation
Network Indicators:
- Unusual API calls to project-related endpoints from unexpected sources
SIEM Query:
source="litmus" AND (projectID OR "project ID") AND status!=200