CVE-2025-8795
📋 TL;DR
This critical vulnerability in LitmusChaos Litmus allows attackers to bypass access controls via improper validation of the projectID parameter in the /auth/login endpoint. Attackers can remotely exploit this to gain unauthorized access to projects or administrative functions. All LitmusChaos Litmus deployments up to version 3.19.0 are affected.
💻 Affected Systems
- LitmusChaos Litmus
📦 What is this software?
Litmus by Litmuschaos
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the LitmusChaos platform, allowing attackers to manipulate chaos experiments, access sensitive project data, or gain administrative control over the system.
Likely Case
Unauthorized access to projects and chaos experiments, potentially allowing attackers to disrupt or manipulate chaos testing workflows.
If Mitigated
Limited impact with proper network segmentation and authentication controls, though the vulnerability still presents an authentication bypass risk.
🎯 Exploit Status
Exploit details have been publicly disclosed on GitHub and VulDB. Attack requires understanding of the LitmusChaos authentication flow but is documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.20.0 or later
Vendor Advisory: Not provided by vendor (vendor did not respond to disclosure)
Restart Required: Yes
Instructions:
1. Upgrade LitmusChaos Litmus to version 3.20.0 or later. 2. Restart all LitmusChaos components. 3. Verify the fix by testing authentication flows.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to the /auth/login endpoint to trusted IP addresses only
Use firewall rules to limit access to LitmusChaos authentication endpoints
Authentication Proxy
allPlace an authentication proxy in front of LitmusChaos that validates projectID before forwarding requests
Configure reverse proxy (nginx, Apache) with custom authentication logic
🧯 If You Can't Patch
- Implement strict network segmentation to isolate LitmusChaos from untrusted networks
- Deploy Web Application Firewall (WAF) with rules to detect and block manipulation of projectID parameter
🔍 How to Verify
Check if Vulnerable:
Check if your LitmusChaos version is 3.19.0 or earlier. Attempt to manipulate projectID parameter in authentication requests to test for bypass.Check Version:
kubectl get deployment -n litmus | grep litmus || Check LitmusChaos UI/API for version informationVerify Fix Applied:
After upgrading to 3.20.0+, test that projectID manipulation no longer allows unauthorized access. Verify proper access controls are enforced.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts with manipulated projectID values
- Failed login attempts followed by successful access from same IP
- Access to projects from unauthorized users
Network Indicators:
- HTTP requests to /auth/login with unusual projectID patterns
- Authentication bypass attempts
SIEM Query:
source="litmus*" AND (uri_path="/auth/login" AND (projectID!="expected_pattern" OR projectID_manipulation_detected))