CVE-2025-8794
📋 TL;DR
This vulnerability in LitmusChaos Litmus allows local attackers to bypass authorization by manipulating the projectID argument in the LocalStorage Handler component. It affects LitmusChaos Litmus versions up to 3.19.0. Attackers need local access to exploit this vulnerability.
💻 Affected Systems
- LitmusChaos Litmus
📦 What is this software?
Litmus by Litmuschaos
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access could gain unauthorized access to project resources, potentially modifying or deleting chaos experiments, configurations, or sensitive project data.
Likely Case
Local users could access projects they shouldn't have permission to view, potentially exposing sensitive chaos testing configurations or results.
If Mitigated
With proper network segmentation and local access controls, impact is limited to authorized local users only.
🎯 Exploit Status
Exploit details are publicly disclosed. Requires local access and some knowledge of the system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.20.0 or later
Vendor Advisory: https://github.com/litmuschaos/litmus
Restart Required: Yes
Instructions:
1. Upgrade LitmusChaos to version 3.20.0 or later. 2. Restart all LitmusChaos components. 3. Verify the upgrade was successful.
🔧 Temporary Workarounds
Restrict Local Access
allLimit local access to LitmusChaos systems to authorized personnel only
Network Segmentation
allIsolate LitmusChaos systems from general user networks
🧯 If You Can't Patch
- Implement strict access controls to limit who has local access to LitmusChaos systems
- Monitor for unauthorized access attempts to LocalStorage Handler component
🔍 How to Verify
Check if Vulnerable:
Check LitmusChaos version: kubectl get pods -n litmus -o jsonpath='{.items[*].spec.containers[*].image}' | grep -o 'litmuschaos/litmus:[0-9.]*'Check Version:
kubectl get pods -n litmus -o jsonpath='{.items[*].spec.containers[*].image}' | grep -o 'litmuschaos/litmus:[0-9.]*'Verify Fix Applied:
Verify version is 3.20.0 or later using the same command and check that authorization checks are working properly📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to LocalStorage Handler
- Failed authorization checks for projectID manipulation
Network Indicators:
- Local connections to LitmusChaos API with suspicious projectID parameters
SIEM Query:
source="litmus" AND ("LocalStorage Handler" OR "projectID") AND ("unauthorized" OR "access denied")