HMAC Signatures and API Keys Logged in Plaintext Across Authentication Components #12006

YLChen-007 · 2025-11-06T13:55:08Z

HMAC Signatures and API Keys Logged in Plaintext Across Authentication Components #11988

boring-cyborg · 2025-11-06T13:55:12Z

Congratulations on your first Pull Request and welcome to the Apache CloudStack community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
Here are some useful points:

In case of a new feature add useful documentation (raise doc PR at https://github.com/apache/cloudstack-documentation)
Be patient and persistent. It might take some time to get a review or get the final approval from the committers.
Pay attention to the quality of your code, ensure tests are passing and your PR doesn't have conflicts.
Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Issues, Mailing list and Slack.
Be sure to read the CloudStack Coding Conventions.
Apache CloudStack is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: [email protected] (https://cloudstack.apache.org/mailing-lists.html)
Slack: https://apachecloudstack.slack.com/

…n tokens) are being logged directly or exposed through exception messages.

DaanHoogland

thanks for picking this up @YLChen-007. some comments but clgtm.

engine/schema/src/main/java/com/cloud/upgrade/DatabaseCreator.java

DaanHoogland · 2025-11-06T14:57:26Z

agent/src/main/java/com/cloud/agent/resource/consoleproxy/ConsoleProxyResource.java

        logger.info("Building class loader for com.cloud.consoleproxy.ConsoleProxy");
        if (consoleProxyMain == null) {
-            logger.info("Running com.cloud.consoleproxy.ConsoleProxy with encryptor password={}", encryptorPassword);
+            logger.info("Running com.cloud.consoleproxy.ConsoleProxy with encryptor password={}", "******");


Suggested change

logger.info("Running com.cloud.consoleproxy.ConsoleProxy with encryptor password={}", "******");

logger.info("Running com.cloud.consoleproxy.ConsoleProxy with encryptor password=******");

core/src/main/java/com/cloud/storage/template/HttpTemplateDownloader.java

DaanHoogland · 2025-11-06T15:01:30Z

server/src/main/java/com/cloud/servlet/ConsoleProxyServlet.java

            if ((signature == null) || (apiKey == null)) {
                if (LOGGER.isDebugEnabled()) {
-                    LOGGER.debug("expired session, missing signature, or missing apiKey -- ignoring request...sig: " + signature + ", apiKey: " + apiKey);
+                    LOGGER.debug("expired session, missing signature, or missing apiKey -- ignoring request");


why do you consider this one harmful? if so, this is going over the connection as well. The apikey should not be a secret and the signature is generated from the apikey and the secretkey so should not give any information.

@DaanHoogland Thank you for the feedback. While I agree that HMAC signatures are
cryptographically secure, I believe logging them still poses security risks:

Key concerns:

Log files ≠ Network transmission: Logs are persistent, often stored in plaintext, and accessible to more parties (developers, ops, log aggregation systems) than encrypted HTTPS traffic.

Replay attack window: If logs are compromised during the signature's validity period, attackers could potentially replay the request.

API Key enumeration: Logging API Keys reveals which accounts exist, enabling targeted attacks and violating information disclosure principles.

Compliance & Best Practice: OWASP and security standards recommend against logging authentication credentials, even derived ones like signatures.

Defense in depth: Even if theoretically safe, removing sensitive data from logs reduces attack surface at minimal cost.

Suggested approach:

Keep the sanitized logging (no signature/apiKey in output)

If debugging is needed, log only partial values (e.g., first 8 chars)

This aligns with the principle of least privilege and real-world security practices.

ok, @YLChen-007 makes sense.

…java Co-authored-by: dahn <[email protected]>

…loader.java Co-authored-by: dahn <[email protected]>

DaanHoogland · 2025-11-07T08:10:00Z

one more remark @YLChen-007 , could you rebase this on the 4.20 branch? It seems applicable to all versions. We usually merge forward from the oldest still supported branch so it will be in 20.3, 22.1 and 23 releases.

YLChen-007 · 2025-11-07T08:15:53Z

one more remark @YLChen-007 , could you rebase this on the 4.20 branch? It seems applicable to all versions. We usually merge forward from the oldest still supported branch so it will be in 20.3, 22.1 and 23 releases.

@DaanHoogland Sure, I'll rebase this PR onto the 4.20 branch.
Give me a moment to update it.

codecov · 2025-11-07T08:16:26Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 3.58%. Comparing base (a50de02) to head (a98887b).

❗ There is a different number of reports uploaded between BASE (a50de02) and HEAD (a98887b). Click for more details.

HEAD has 1 upload less than BASE

Flag BASE (a50de02) HEAD (a98887b)

unittests 1 0

Additional details and impacted files

@@              Coverage Diff              @@
##               main   #12006       +/-   ##
=============================================
- Coverage     17.56%    3.58%   -13.98%     
=============================================
  Files          5909      445     -5464     
  Lines        529059    37534   -491525     
  Branches      64617     6901    -57716     
=============================================
- Hits          92919     1346    -91573     
+ Misses       425687    36024   -389663     
+ Partials      10453      164    -10289

Flag	Coverage Δ
uitests	`3.58% <ø> (ø)`
unittests	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

DaanHoogland · 2025-11-07T08:43:48Z

one more remark @YLChen-007 , could you rebase this on the 4.20 branch? It seems applicable to all versions. We usually merge forward from the oldest still supported branch so it will be in 20.3, 22.1 and 23 releases.

@DaanHoogland Sure, I'll rebase this PR onto the 4.20 branch. Give me a moment to update it.

Thanks @YLChen-007 , the linter had some complaints about trailing spaces. Please take those into account as well.

The rebasing can be considered for all you recent contributions, btw.

remove log out sensitive information

f9a6394

sensitive information (passwords, database credentials, authenticatio…

c18a163

…n tokens) are being logged directly or exposed through exception messages.

boring-cyborg bot added the component:agent label Nov 6, 2025

DaanHoogland approved these changes Nov 6, 2025

View reviewed changes

YLChen-007 and others added 2 commits November 7, 2025 09:32

Update engine/schema/src/main/java/com/cloud/upgrade/DatabaseCreator.…

15b1cd8

…java Co-authored-by: dahn <[email protected]>

Update core/src/main/java/com/cloud/storage/template/HttpTemplateDown…

a98887b

…loader.java Co-authored-by: dahn <[email protected]>

DaanHoogland added the status:needs-testing label Nov 7, 2025

DaanHoogland added this to the 4.23 milestone Nov 7, 2025

YLChen-007 changed the base branch from main to 4.20 November 7, 2025 13:08

boring-cyborg bot added the component:integration label Nov 7, 2025

YLChen-007 changed the base branch from 4.20 to main November 7, 2025 13:10

YLChen-007 closed this Nov 7, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

HMAC Signatures and API Keys Logged in Plaintext Across Authentication Components #12006

HMAC Signatures and API Keys Logged in Plaintext Across Authentication Components #12006

Uh oh!

YLChen-007 commented Nov 6, 2025

Uh oh!

boring-cyborg bot commented Nov 6, 2025

Uh oh!

DaanHoogland left a comment

Uh oh!

Uh oh!

DaanHoogland Nov 6, 2025

Uh oh!

Uh oh!

DaanHoogland Nov 6, 2025

Uh oh!

YLChen-007 Nov 7, 2025

Uh oh!

DaanHoogland Nov 7, 2025

Uh oh!

DaanHoogland commented Nov 7, 2025

Uh oh!

YLChen-007 commented Nov 7, 2025

Uh oh!

codecov bot commented Nov 7, 2025 •

edited

Loading

Uh oh!

DaanHoogland commented Nov 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	logger.info("Running com.cloud.consoleproxy.ConsoleProxy with encryptor password={}", "******");
	logger.info("Running com.cloud.consoleproxy.ConsoleProxy with encryptor password=******");

HMAC Signatures and API Keys Logged in Plaintext Across Authentication Components #12006

HMAC Signatures and API Keys Logged in Plaintext Across Authentication Components #12006

Uh oh!

Conversation

YLChen-007 commented Nov 6, 2025

Uh oh!

boring-cyborg bot commented Nov 6, 2025

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

DaanHoogland Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

DaanHoogland Nov 6, 2025

Choose a reason for hiding this comment

Uh oh!

YLChen-007 Nov 7, 2025

Choose a reason for hiding this comment

Uh oh!

DaanHoogland Nov 7, 2025

Choose a reason for hiding this comment

Uh oh!

DaanHoogland commented Nov 7, 2025

Uh oh!

YLChen-007 commented Nov 7, 2025

Uh oh!

codecov bot commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

DaanHoogland commented Nov 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented Nov 7, 2025 •

edited

Loading