CVE-2025-8796
📋 TL;DR
This vulnerability in LitmusChaos Litmus allows unauthorized deletion of projects due to missing authorization checks in the delete project endpoint. Attackers can remotely delete projects without proper permissions. Affects LitmusChaos Litmus users up to version 3.19.0.
💻 Affected Systems
- LitmusChaos Litmus
📦 What is this software?
Litmus by Litmuschaos
⚠️ Risk & Real-World Impact
Worst Case
Malicious actors delete critical chaos engineering projects, disrupting testing environments and potentially affecting production system reliability.
Likely Case
Unauthorized project deletion causing loss of chaos experiment configurations and disruption to testing workflows.
If Mitigated
Minimal impact with proper network segmentation and authentication controls limiting access to the vulnerable endpoint.
🎯 Exploit Status
Exploit details are publicly available in the referenced GitHub repository. Attack requires some level of access but bypasses authorization checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.20.0 or later
Vendor Advisory: Not specified in provided references
Restart Required: No
Instructions:
1. Upgrade LitmusChaos Litmus to version 3.20.0 or later. 2. Verify the fix by testing project deletion with unauthorized users. 3. Review and update any custom configurations.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to the LitmusChaos API endpoints using firewall rules or network policies
API Gateway Authentication
allImplement additional authentication layer at API gateway level for all /auth/ endpoints
🧯 If You Can't Patch
- Implement strict network segmentation to isolate LitmusChaos deployment from untrusted networks
- Enable detailed audit logging for all project deletion attempts and monitor for unauthorized access patterns
🔍 How to Verify
Check if Vulnerable:
Check if LitmusChaos version is 3.19.0 or earlier. Attempt unauthorized project deletion via /auth/delete_project/ endpoint.Check Version:
kubectl get deployment litmus -n litmus -o jsonpath='{.spec.template.spec.containers[0].image}' | grep -o ':[0-9.]*'Verify Fix Applied:
After upgrading to 3.20.0+, verify that unauthorized users cannot delete projects via the affected endpoint.📡 Detection & Monitoring
Log Indicators:
- Unauthorized DELETE requests to /auth/delete_project/
- Failed authentication attempts followed by successful project deletions
- Multiple project deletion requests from single user in short timeframe
Network Indicators:
- Unusual DELETE request patterns to authentication endpoints
- Traffic to /auth/delete_project/ from unexpected IP ranges
SIEM Query:
source="litmus-logs" AND (uri_path="/auth/delete_project/" AND http_method="DELETE") AND (NOT user_role="admin" OR auth_status="failed")