An authenticated privilege escalation vulnerability in Ubuntu MAAS allows low-privileged users to gain full administrative control over the deployment, posing a critical security risk.

This vulnerability involves improper privilege management within the user websocket handler, where the application fails to validate the is_superuser property during a user.update request. An authenticated, unprivileged attacker can exploit this to self-promote to an administrative role.

Successful exploitation results in a complete compromise of the MAAS environment, as the attacker gains full administrative privileges. Given the CVSS score of 7.7, this represents a high-severity threat that could lead to unauthorized infrastructure management, data manipulation, or complete control over provisioned nodes, severely impacting the integrity and availability of the managed environment.

Immediate Action: Upgrade to the latest available version of Ubuntu MAAS, specifically version 3.7.0 or 3.8.0, which contain the necessary security fixes.

Proactive Monitoring: Monitor websocket traffic for unusual user.update requests, particularly those containing unexpected property injections, and audit administrative user lists for unauthorized account elevation.

Compensating Controls: Implement strict network access controls to limit access to the MAAS management interface to trusted administrative networks only, reducing the attack surface for potentially malicious authenticated users.

Public Exploit Available: Unknown.

The ability for an unprivileged user to gain full administrative rights is a critical failure in access control that must be addressed immediately. Organizations utilizing Ubuntu MAAS should prioritize patching to the versions listed above to prevent potential lateral movement and full system takeover by malicious insiders or compromised user accounts.