CVE-2025-7044: Privilege Escalation in MAAS via Websocket Request Manipulation
An Improper Input Validation vulnerability exists in the user websocket handler of MAAS. An authenticated, unprivileged attacker can intercept a user.update websocket request and inject the issuperuser property set to true. The server improperly validates this input, allowing the attacker to self-promote to an administrator role. This results in full administrative control over the MAAS deployment.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7044?
CVE-2025-7044 is classified as a critical severity vulnerability due to its potential for unauthorized privilege escalation.
How do I fix CVE-2025-7044?
To fix CVE-2025-7044, ensure to update the MAAS to the latest patched version that addresses this input validation flaw.
Who is affected by CVE-2025-7044?
CVE-2025-7044 affects users of MAAS as the vulnerability exploits the websocket handler for user updates.
What kind of attack does CVE-2025-7044 enable?
CVE-2025-7044 enables an authenticated, unprivileged attacker to gain escalated privileges by injecting arbitrary properties into a websocket request.
What impact does CVE-2025-7044 have on system security?
The impact of CVE-2025-7044 can lead to unauthorized access and control over user privileges, significantly compromising system security.