CVE-2025-54289: 
NixOS vulnerability analysis and mitigation

CVE-2025-54289 is a privilege escalation vulnerability in Canonical LXD's operations API, exploitable via WebSocket connection hijacking. Attackers with only read permissions can obtain WebSocket authentication secrets exposed by the operations API and use them to hijack terminal or console sessions opened by higher-privileged users, enabling arbitrary command execution within instances. Affected versions include LXD 4.0.0 through 5.21.3 and 6.1 through 6.4; patched versions are 5.21.4 and 6.5. The vulnerability was published on October 2, 2025, and was reported by GMO Flatt Security Inc. It carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.4 (High) (GitHub Advisory, Canonical Advisory).

The root cause is an improper information disclosure in lxd/operations.go, classified as CWE-1385 (Missing Origin Validation in WebSockets): the operations API returns full operation metadata — including WebSocket authentication secrets (fds field) — to all authenticated users regardless of their permission level, violating the principle of least privilege (GitHub Advisory). An attacker with read-only access can subscribe to the /1.0/events API to capture operation events containing these secrets, then establish their own WebSocket connection to /1.0/operations/{operationId}/websocket using the stolen secret before or instead of the legitimate user. The attack requires low privileges, network access, and precise timing — the attacker must connect to the WebSocket before the legitimate victim does, as the first connection wins session rights (Canonical Advisory). A proof-of-concept JavaScript exploit leveraging the LXD-UI browser interface is publicly documented in the advisory.

Successful exploitation allows a low-privileged attacker to hijack terminal or console sessions belonging to higher-privileged users, effectively escalating their privileges and executing arbitrary commands inside LXD instances with the victim's permissions. This results in high confidentiality and integrity impact — an attacker can read sensitive data, modify files, and perform unauthorized actions within the compromised container. Availability is not directly impacted, and the scope is limited to the vulnerable LXD system without lateral movement to subsequent systems (GitHub Advisory, Canonical Advisory).

A proof-of-concept exploit in the form of JavaScript code is publicly documented in the official security advisory, demonstrating session hijacking via the LXD-UI browser interface (Canonical Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported (GitHub Advisory). The EPSS score is approximately 0.047% (15th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Qualys (IDs: 6271255, 6563561) and Nessus (ID: 270713).

1. Gain read-only access: Obtain a low-privileged account with read permissions on the target LXD project, either through legitimate provisioning or credential compromise.
2. Access LXD-UI: Log in to the LXD web interface (LXD-UI) using the read-only account.
3. Subscribe to operation events: Open browser DevTools and inject JavaScript that subscribes to the /1.0/events?type=operation&all-projects=true WebSocket endpoint to monitor for new terminal/console operation events.
4. Capture WebSocket secrets: When a higher-privileged user starts a terminal or console session, the events API delivers the operation metadata including the fds field containing WebSocket authentication secrets (e.g., secrets['0'] for the data channel and secrets.control for the control channel).
5. Hijack the WebSocket session: Using the captured operationId and secrets, immediately establish WebSocket connections to /1.0/operations/{operationId}/websocket?secret={secret} for both the data and control channels — racing the legitimate user to connect first.
6. Execute arbitrary commands: Send commands over the data channel WebSocket (e.g., touch /tmp/xxx\r) which execute inside the victim's container session with the victim's privileges, achieving privilege escalation (Canonical Advisory).

• Network: Unexpected WebSocket connections to /1.0/operations/{operationId}/websocket from accounts with read-only permissions; multiple simultaneous WebSocket connections to the same operation ID from different source IPs or sessions.
• Logs: LXD API access logs showing read-only user accounts querying /1.0/events?type=operation followed shortly by WebSocket upgrade requests to /1.0/operations/*/websocket; operation events accessed by users who did not initiate the corresponding terminal/console session.
• File System: Unexpected files created inside containers (e.g., /tmp/xxx or similar artifacts) by processes not initiated by the container's legitimate user.
• Process: Unusual commands executed within LXD instances that do not correspond to actions taken by the authorized session owner, particularly shortly after a terminal/console session was opened by another user (Canonical Advisory).

Canonical has released patched versions: LXD 6.5 (for the 6.x series) and LXD 5.21.4 (for the 5.21.x series); the 5.0 and 4.0 series are not receiving fixes as they are considered not critical or end-of-life (Canonical Advisory). The fix involves modifying lxd/operations.go to check user permissions and exclude WebSocket secrets (fds field) from operation metadata returned to read-only users. As interim workarounds, administrators should strictly limit API access, avoid granting read permissions to untrusted users, monitor and restrict WebSocket connections, and implement network segmentation around the LXD API endpoint. Upgrading to a patched version is the recommended and definitive remediation.

The vulnerability was reported by GMO Flatt Security Inc. and disclosed responsibly through Canonical's security advisory process (Canonical Advisory). Debian issued security updates for the related Incus package (DSA-6027-1) and Debian Backports Security Advisory BSA-125, reflecting downstream impact on Linux distributions. Detection coverage was added by Tenable (Nessus plugin 270713) and Qualys shortly after disclosure. No significant social media controversy or broad media coverage has been identified beyond standard vulnerability tracking and advisory channels.