The required feature described as a wish
Description: By default, CloudStack uses a hard-coded password for all System VMs.
Affected Components: System VMs (SSVM, CPVM, and VR)
Impact: An attacker who knows the default credentials, which are publicly documented, and has console access to any System VM could log in as root.
- On a VR: the attacker could act as a man-in-the-middle (MITM).
- On a SSVM: the attacker could tamper with templates and ISOs, and delete snapshots.
- On a CPVM: the attacker could potentially install a keylogger on noVNC sessions.
Steps to Reproduce:
- Open the Console of any System VM.
- Enter the default username
root and password password.
Recommended Remediation: Enable randomization of System VM passwords by default, while allowing administrators to disable this behavior if needed.
Note: This feature already exists. Additionally, documentation improvements have been proposed to clarify how to enable and use it.
The required feature described as a wish
Description: By default, CloudStack uses a hard-coded password for all System VMs.
Affected Components: System VMs (SSVM, CPVM, and VR)
Impact: An attacker who knows the default credentials, which are publicly documented, and has console access to any System VM could log in as
root.Steps to Reproduce:
rootand passwordpassword.Recommended Remediation: Enable randomization of System VM passwords by default, while allowing administrators to disable this behavior if needed.
Note: This feature already exists. Additionally, documentation improvements have been proposed to clarify how to enable and use it.