github-actions[bot] commented on issue #14530: URL: https://github.com/apache/cloudstack/issues/14530#issuecomment-6520628852
> [!WARNING] > threat detection engine error > The threat detection engine encountered an error and could not complete analysis. This is a tooling failure, not a security finding. > > <!-- gh-aw-threat-engine-error --> > > <details> > <summary>What happened</summary> > > The threat detection engine failed to produce results. > > Review the [workflow run logs](https://github.com/apache/cloudstack/actions/runs/41040764159) for details. > > </details> ## 🎯 Triage report The report says the `userdata` parameter of `DeployVMCmd` is stored base64-encoded in the `async_job.job_cmd_info` column, so anyone with DB read access can decode cloud-init content that often includes plaintext passwords. The suggested fix is to redact `userdata` before the params are serialised in `ApiServer`. The same pattern is in F-18 and F-19 of this hardening series. **Scope check for maintainers:** `THREAT_MODEL.md` §3 item 6 and Q10 say user-data is tenant-controlled guest customisation and is not a CloudStack-side injection surface. §9 says the database is trusted for its own security, but credential handling is in scope. Whether leaking tenant user-data via DB read access is in scope needs a maintainer decision. **Reporting channel:** `SECURITY.md` asks for suspected vulnerabilities to be reported privately to [email protected] and not in public issues. Maintainers may want to confirm whether this report should be handled there. ### 📊 Assessment | Dimension | Value | Reasoning | | --- | --- | --- | | **Type** | type:security | Report describes credential exposure in DB content | | **Component** | component:database | Storage of `job_cmd_info` in `async_job`; the redaction point is in the API layer | | **Severity** | n/a | Not assessed; depends on the scope decision above | | **Labels** | type:security, component:database | | | **Coding agent** | Not suitable | Scope decision and security review needed before any change | ### 🔗 Similar issues - #13301 (related) — sensitive password leak in async job status update logging (`updateAsyncJobStatus`); same class of issue - #9512 (related, closed) — passwords in plaintext in management and access logs <details> <summary>💡 Notes and suggestions</summary> - The reporter's SQL query and decoding steps are in the issue. Only maintainers should decide whether to keep reproduction details public. - Redaction at serialisation (as suggested) would also need to cover any other path that stores the `DeployVMCmd` params. </details> > Generated by [Daily Issue Triage](https://github.com/apache/cloudstack/actions/runs/41040764159) · copilot · haiku55 · \~3 AIC · ⊞ 3.8K · [◷](https://github.com/search?q=repo%3Aapache%2Fcloudstack+%22gh-aw-workflow-call-id%3A+apache%2Fcloudstack%2Fdaily-issue-triage%22&type=issues) <details> <summary><sub>Add this agentic workflow to your repo</sub></summary> To install this agentic workflow, run ``` gh aw add githubnext/agentics/workflows/daily-issue-triage.md@139fa09ef17cde4135e696ff8e7af09bc5ddfa6e ``` </details> <!-- gh-aw-workflow-call-id: apache/cloudstack/daily-issue-triage --> <!-- gh-aw-agentic-workflow: Daily Issue Triage, engine: copilot, model: claude-haiku-5.5, id: 41040764159, workflow_id: daily-issue-triage, run: https://github.com/apache/cloudstack/actions/runs/41040764159 --> <!-- gh-aw-execution: {"version":1,"repo_id":"9759448","repository":"apache/cloudstack","aw_workflow_id":"daily-issue-triage","run_id":"41040764159","run_attempt":"1","run_url":"https://github.com/apache/cloudstack/actions/runs/41040764159","publishing_job":{"key":"safe_outputs","check_run_id":"124016161242"}} --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
