| 제목 | aiyiyi121 SxDevOps 1.1 Hard-coded Credentials |
|---|
| 설명 | SxDevOps contains a hardcoded default superadmin password Admin@123456 in two locations:
1. Backend: rbac/services.py defines DEFAULT_ADMIN_PASSWORD = 'Admin@123456' and ensure_default_superuser() creates a superadmin account with this password on first startup.
2. Frontend: frontend/src/views/Login.vue displays the default credentials on the login page and pre-fills the login form with admin / Admin@123456.
Anyone who visits the SxDevOps login page can see and use these credentials to log in as superadmin. If the password is never changed (the default behavior), the entire platform is accessible to any visitor without any technical exploitation.
Vulnerable code:
Backend rbac/services.py lines 11-12:
DEFAULT_ADMIN_USERNAME = "admin"
DEFAULT_ADMIN_PASSWORD = "Admin@123456"
Frontend Login.vue lines 95, 120-122:
username: 'admin', password: 'Admin@123456'
Impact: Trivial initial access with superadmin privileges, enabling full platform control and cascading RCE via MCP STDIO command injection. |
|---|
| 원천 | ⚠️ https://github.com/aiyiyi121/sxdevops/issues/16 |
|---|
| 사용자 | _lxf (UID 63911) |
|---|
| 제출 | 2026. 08. 24. AM 04:49 (27 날 ago) |
|---|
| 모더레이션 | 2026. 09. 19. PM 12:15 (26 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 407928 [aiyiyi121 SxDevOps 1.0/1.1 rbac/services.py ensure_default_superuser 약한 인증] |
|---|
| 포인트들 | 20 |
|---|