apache / apache/cloudstack

Weak Default Password on System VMs.

未關閉
#14,075 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
component:csvm component:ssvm component:virtual-router type:security
主要語言
Java
星號
3.1k
分支
1.4k
平均合併
7 天 14 小時
30 天內合併 PR
31

描述

### The required feature described as a wish

**Description:** By default, CloudStack uses a hard-coded password for all System VMs.

**Affected Components:** System VMs (SSVM, CPVM, and VR)

**Impact:** An attacker who knows the default credentials, which are publicly documented, and has console access to any System VM could log in as `root`.

- On a VR: the attacker could act as a man-in-the-middle (MITM).
- On a SSVM: the attacker could tamper with templates and ISOs, and delete snapshots.
- On a CPVM: the attacker could potentially install a keylogger on noVNC sessions.

Steps to Reproduce:

- Open the Console of any System VM.
- Enter the default username `root` and password `password`.

**Recommended Remediation:** Enable randomization of System VM passwords by default, while allowing administrators to disable this behavior if needed.

**Note:** This feature already exists. Additionally, documentation improvements have been proposed to clarify how to enable and use it.

貢獻指南

開啟貢獻指南

研究方向

首先定位現有的 System VM 密碼隨機化功能,以及本 issue 中提議的文件;未指定具體檔案或測試。檢查該行為如何套用於 SSVM、CPVM 和 VR,包括設定預設值和退出選項。完成的標準是密碼預設進行隨機化,管理員仍然可以停用該行為,並且使用方式得到清楚的文件說明。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
java
領域
cloud, infrastructure, security
Issue 類型
功能
難度
4/5
預估耗時
3-5 天
活躍度
活躍
描述清晰度
基本清楚
新手友好度
48/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。