Skip to content

Password Exposure in IPMI Tool Command Execution #12027

@YLChen-007

Description

@YLChen-007

Summary

A security vulnerability has been identified in the Apache CloudStack Out-of-Band Management IPMI tool driver where plaintext passwords are logged when trace-level logging is enabled. The password passed via cmd.getNewPassword() is included in the command arguments and subsequently exposed through debug logging.

Vulnerability Details

Component: org.apache.cloudstack.outofbandmanagement.driver.ipmitool.IpmitoolOutOfBandManagementDriver

Vulnerability Type: Sensitive Information Disclosure / Password Exposure in Logs

Severity: Medium to High (depending on logging configuration and log access controls)

Technical Description

In the execute(OutOfBandManagementDriverChangePasswordCommand cmd) method, the new password is passed directly to the IPMI tool command arguments:

final List<String> ipmiToolCommands = IPMITOOL.getIpmiToolCommandArgs(IpmiToolPath.value(),
        IpmiToolInterface.value(), IpmiToolRetries.value(),
        cmd.getOptions(), "user", "set", "password", outOfBandManagementUserId, cmd.getNewPassword());

return IPMITOOL.executeCommands(ipmiToolCommands, cmd.getTimeout())

//OutOfBandManagementDriverResponse org.apache.cloudstack.outofbandmanagement.driver.ipmitool.IpmitoolWrapper.executeCommands(List<String> commands, Duration timeOut)
public OutOfBandManagementDriverResponse executeCommands(final List<String> commands, final Duration timeOut) {
     final ProcessResult result = RUNNER.executeCommands(commands, timeOut);
     ...
}

These commands are finally passed to org.apache.cloudstack.utils.process.ProcessRunner.executeCommands(List<String> commands, Duration timeOut), which logs the complete command string without improper sanitization when debug logging is enabled:

  String commandLog = removeCommandSensitiveInfoForLogging(StringUtils.join(commands, " "));
  logger.debug("Preparing command [{}] to execute.", commandLog);
  final Process process = new ProcessBuilder().command(commands).start();

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions