Canonical LXD Project Existence Determination Through Error Handling in Image Export Function
Date: 2025-10
Affected: go/github.com/canonical/lxd, go/github.com/canonical/lxd, go/github.com/canonical/lxd
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-54290
CWE: CWE-200

### Impact In LXD's images export API (`/1.0/images/{fingerprint}/export`), implementation differences in error handling allow determining project existence without authentication. Specifically, in the following code, errors when multiple images match are directly returned to users as API responses: https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/db/images.go#L239-L246 While fingerprints generally don't duplicate, this functionality uses fingerprints with LIKE clauses, allowing prefix specification. Therefore, using LIKE wildcards such as % will match multiple images if multiple images exist in the project. https://github.com/canonical/lxd/blob/43d5189564d27f6161b430ed258c8b56603c2759/lxd/db/images.go#L277-L286 In the above implementation, multiple matches result in a 500 error, but if the project itself doesn't exist, there are 0 matches and a 404 is returned. 1. When project exists and multiple images match: HTTP 500 error "More than one image matches" 2. When project doesn't exist: HTTP 404 error "not found" This behavioural difference allows attackers to confirm project existence without authentication. ### Reproduction Steps 1. Send a request with a pattern matching multiple entries to an existing project (default): ``` curl -k 'https://lxd-host:8443/1.0/images/%25/export?project=default&secret=x' ``` Response: ```json {"type":"error","status":"","status_code":0,"operation":"","error_code":500,"error":"More than one image m


Mitigations:

Architectural layers (MAESTRO):