davift opened a new issue, #14530: URL: https://github.com/apache/cloudstack/issues/14530
### The required feature described as a wish **Description:** The `userdata` parameter supplied to DeployVMCmd is stored base64-encoded (not encrypted) in DB. Base64 does not offer adequate protection for sensitive information, and in practice the decoded cloud-init frequently contains plaintext passwords (`plain_text_passwd`, `passwd`, `chpasswd`). Because user data is opaque to the platform, its contents cannot be selectively filtered. The field must be treated as sensitive in its entirety. <img width="929" height="290" alt="Image" src="https://github.com/user-attachments/assets/0ead0fde-5e44-4c71-8560-8d7166927560"; /> **Affected Components:** Management API / DB (`cloud`.`async_job`, column `job_cmd_info`). **Impact:** Anyone with read access to the database can base64-decode the stored user data and recover any plaintext credentials the user set in their cloud-init, including passwords for accounts configured with passwordless sudo, thereby granting effective root on the guest. **Steps to Reproduce:** - Deploy an instance with cloud-init userdata that sets a user password (e.g., `plain_text_passwd` or a `chpasswd` block). - Query the database: - mysql> `SELECT job_cmd_info FROM async_job WHERE job_cmd LIKE '%DeployVMCmd%' AND job_cmd_info LIKE '%"userdata":%';` - Base64-decode the `userdata` value and observe the embedded credentials in cleartext. **Recommended Remediation:** Redact or omit the `userdata` attribute from params before the `toJson(params)` serialization (this is the same code site that F-18 identifies for the top-level password parameter). It is recommended to treat the whole cloud-init field as sensitive, like in F-19. https://github.com/apache/cloudstack/blob/4.22.0.0/server/src/main/java/com/cloud/api/ApiServer.java#L825 **See more examples:** <img width="353" height="495" alt="Image" src="https://github.com/user-attachments/assets/05ae00dd-e559-4fe6-8418-4321872bb29b"; /> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
