| 标题 | aiyiyi121 SxDevOps 1.1 Hard-coded Credentials |
|---|
| 描述 | SxDevOps contains a hardcoded default superadmin password Admin@123456 in two locations:
1. Backend: rbac/services.py defines DEFAULT_ADMIN_PASSWORD = 'Admin@123456' and ensure_default_superuser() creates a superadmin account with this password on first startup.
2. Frontend: frontend/src/views/Login.vue displays the default credentials on the login page and pre-fills the login form with admin / Admin@123456.
Anyone who visits the SxDevOps login page can see and use these credentials to log in as superadmin. If the password is never changed (the default behavior), the entire platform is accessible to any visitor without any technical exploitation.
Vulnerable code:
Backend rbac/services.py lines 11-12:
DEFAULT_ADMIN_USERNAME = "admin"
DEFAULT_ADMIN_PASSWORD = "Admin@123456"
Frontend Login.vue lines 95, 120-122:
username: 'admin', password: 'Admin@123456'
Impact: Trivial initial access with superadmin privileges, enabling full platform control and cascading RCE via MCP STDIO command injection. |
|---|
| 来源 | ⚠️ https://github.com/aiyiyi121/sxdevops/issues/16 |
|---|
| 用户 | _lxf (UID 63911) |
|---|
| 提交 | 2026-08-24 04時49分 (27 日前) |
|---|
| 管理 | 2026-09-19 12時15分 (26 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 407928 [aiyiyi121 SxDevOps 1.0/1.1 rbac/services.py ensure_default_superuser 弱身份验证] |
|---|
| 积分 | 20 |
|---|