JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdline endpoint to obtain the process command line containing metadata engine connection strings with database credentials, granting full read/write access to filesystem metadata, while other pprof handlers leak internal state and profiling handlers enable denial of service.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Juicedata Juicefs
cpe:2.3:a:juicedata:juicefs:*:*:*:*:*:*:*:*
|
— |
<= 1.3.1
|
References 4
https://github.com/juicedata/juicefs/commit/a46979cdd4082217081ee99b931ddc53d03…
disclosure@vulncheck.com
https://github.com/juicedata/juicefs/issues/7213
disclosure@vulncheck.com
https://github.com/juicedata/juicefs/pull/7214
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/juicefs-authentication-bypass-via-pprof-an…
disclosure@vulncheck.com