Security Vulnerability Report: Sensitive User Data and SSH Public Key Exposure in VM Metadata Logging

## Description

We have identified a security vulnerability where sensitive data (user-data and public-keys) is exposed through application logs during the execution of `VmDataCommand`.

## Data Flow

### 1. Sensitive Data Injection

In `com.cloud.network.router.CommandSetupHelper.generateVmDataCommand`, sensitive information including user data and public keys is added to the `VmDataCommand`:

```java
// com.cloud.network.router.CommandSetupHelper.generateVmDataCommand
private VmDataCommand generateVmDataCommand(final VirtualRouter router, final String vmPrivateIpAddress, final String userData, String userDataDetails, final String serviceOffering,
final String zoneName, final String publicIpAddress, final String vmName, final String vmInstanceName, final long vmId, final String vmUuid, final String publicKey,
final long guestNetworkId, String hostname) {
final VmDataCommand cmd = new VmDataCommand(vmPrivateIpAddress, vmName, _networkModel.getExecuteInSeqNtwkElmtCmd());

...

cmd.addVmData("userdata", "user-data", userData);
...
cmd.addVmData("metadata", "public-keys", publicKey);
```

### 2. Script Construction with Sensitive Data

In `com.cloud.baremetal.networkservice.BaremetalKickStartPxeResource.execute`, the VM data containing sensitive information is retrieved and embedded into a shell script command:

```java
//com.cloud.baremetal.networkservice.BaremetalKickStartPxeResource.execute
private Answer execute(VmDataCommand cmd) {
com.trilead.ssh2.Connection sshConnection = new com.trilead.ssh2.Connection(_ip, 22);
try {
List vmData = cmd.getVmData();
StringBuilder sb = new StringBuilder();
for (String[] data : vmData) {
String folder = data[0];
String file = data[1];
String contents = (data[2] == null) ? "none" : data[2];
sb.append(cmd.getVmIpAddress());
sb.append(",");
sb.append(folder);
sb.append(",");
sb.append(file);
sb.append(",");
sb.append(contents); // Sensitive data included here
sb.append(";");
}
String arg = StringUtils.stripEnd(sb.toString(), ";");

String script = String.format("python /usr/bin/baremetal_user_data.py '%s'", arg);
if (!SSHCmdHelper.sshExecuteCmd(sshConnection, script)) {
return new Answer(cmd, false, "Failed to add user data, command:" + script);
}
```

### 3. Sensitive Data Logged

Finally, in `com.cloud.utils.ssh.SSHCmdHelper.sshExecuteCmdOneShot`, the constructed script containing sensitive data is logged at DEBUG level:

```java
// com.cloud.utils.ssh.SSHCmdHelper.sshExecuteCmdOneShot
public static SSHCmdResult sshExecuteCmdOneShot(com.trilead.ssh2.Connection sshConnection, String cmd) throws SshException {
LOGGER.debug("Executing cmd: " + cmd.split(KeyStoreUtils.KS_FILENAME)[0]); // ← Sensitive data logged here
Session sshSession = null;
try {
sshSession = sshConnection.openSession();
Thread.sleep(1000);

if (sshSession == null) {
throw new SshException("Cannot open ssh session");
}
// ... execution continues
}
...
if (!StringUtils.isAllEmpty(result.getStdOut(), result.getStdErr())) {
LOGGER.debug("SSH command: " + cmd.split(KeyStoreUtils.KS_FILENAME)[0] + "\nSSH command output:" + result.getStdOut().split("-----BEGIN")[0] + "\n" + result.getStdErr()); // ← Sensitive data logged here again
}
}
```

## Security Impact

This vulnerability results in sensitive information being written to application logs, including:
- **User-data**: May contain passwords, API keys, configuration secrets, or other confidential initialization data
- **Public keys**: SSH public keys that could be used for reconnaissance or social engineering attacks

When debug logging is enabled, this sensitive data becomes accessible to anyone with access to the log files, potentially including:
- System administrators
- Log aggregation systems
- Backup systems
- Attackers who gain unauthorized access to log storage

This constitutes a violation of security best practices and may lead to unauthorized access or information disclosure.

從 com.cloud.utils.ssh.SSHCmdHelper.sshExecuteCmdOneShot 開始，接著透過 com.cloud.baremetal.networkservice.BaremetalKickStartPxeResource.execute 和 com.cloud.network.router.CommandSetupHelper.generateVmDataCommand 追蹤命令的建構方式。檢視除錯訊息如何暴露命令內容；完成的標準是 user-data 和公開金鑰不再寫入記錄，同時命令執行仍維持正常。

由索引模型根據 Issue 內容生成。