| शीर्षक | aiyiyi121 SxDevOps 1.1 Hard-coded Credentials |
|---|
| विवरण | SxDevOps contains a hardcoded default superadmin password Admin@123456 in two locations:
1. Backend: rbac/services.py defines DEFAULT_ADMIN_PASSWORD = 'Admin@123456' and ensure_default_superuser() creates a superadmin account with this password on first startup.
2. Frontend: frontend/src/views/Login.vue displays the default credentials on the login page and pre-fills the login form with admin / Admin@123456.
Anyone who visits the SxDevOps login page can see and use these credentials to log in as superadmin. If the password is never changed (the default behavior), the entire platform is accessible to any visitor without any technical exploitation.
Vulnerable code:
Backend rbac/services.py lines 11-12:
DEFAULT_ADMIN_USERNAME = "admin"
DEFAULT_ADMIN_PASSWORD = "Admin@123456"
Frontend Login.vue lines 95, 120-122:
username: 'admin', password: 'Admin@123456'
Impact: Trivial initial access with superadmin privileges, enabling full platform control and cascading RCE via MCP STDIO command injection. |
|---|
| स्रोत | ⚠️ https://github.com/aiyiyi121/sxdevops/issues/16 |
|---|
| उपयोगकर्ता | _lxf (UID 63911) |
|---|
| सबमिशन | 24/08/2026 04:49 AM (27 दिन पहले) |
|---|
| संयम | 19/09/2026 12:15 PM (26 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 407928 [aiyiyi121 SxDevOps 1.0/1.1 rbac/services.py ensure_default_superuser कमजोर प्रमाणीकरण] |
|---|
| अंक | 20 |
|---|