MAAS Improper Input Validation Vulnerability in Websocket User Handler Allows Unauthorized Privilege Escalation

A vulnerability allowing improper input validation has been identified in the user websocket handler of MAAS. This issue enables an authenticated, unprivileged attacker to intercept websocket requests related to user updates and inject the is_superuser property, setting it to true. The server's failure to properly validate this input allows the attacker to elevate their privileges to an administrator role, granting full administrative control over the MAAS deployment.

Impact

Exploitation of this vulnerability allows for unauthorized privilege escalation, enabling an attacker to gain full administrative rights within the MAAS environment.