High · published December 3, 2025
⚡ Just a tweak in the websocket can make an attacker the new boss! An unprivileged user can inject the ‘is_superuser’ property into a request and suddenly go from zero to hero. 🚀 Think of it like a waiter who sneaks into the restaurant's kitchen and changes their job title to head chef on the manager’s tablet—suddenly, they can change menus and kick out customers without anyone noticing! This sneaky input validation flaw means an attacker could gain full admin control over your MAAS deployment, potentially leading to absolute chaos—altering configurations, accessing sensitive data, or even shutting down services. It's like handing over the keys to your castle without realizing the door was left unlocked!
Think of it like a waiter who sneaks into the restaurant's kitchen and changes their job title to head chef on the manager’s tablet—suddenly, they can change menus and kick out customers without anyone noticing! The vulnerability allows an authenticated user to manipulate a websocket request, injecting an unchecked property that promotes them to an administrator role. The server fails to properly validate this input, letting the attacker bypass normal access controls.
This sneaky input validation flaw means an attacker could gain full admin control over your MAAS deployment, potentially leading to absolute chaos—altering configurations, accessing sensitive data, or even shutting down services. It's like handing over the keys to your castle without realizing the door was left unlocked! To secure your system, patch MAAS to the latest version as soon as possible. Ensure you've reviewed and updated your input validation practices across the board to prevent this kind of sneaky exploitation. Don't forget to audit access logs for any suspicious activity in the meantime! You’ve got this! Follow these steps, and you’ll lock down your MAAS deployment in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| canonical/maas | ≥ 3.3.0, < 3.3.11 | 3.3.11 |
| canonical/maas | ≥ 3.4.0, < 3.4.9 | 3.4.9 |
| canonical/maas | ≥ 3.5.0, < 3.5.9 | 3.5.9 |
| canonical/maas | ≥ 3.6.0, < 3.6.2 | 3.6.2 |