PT-2022-19439 · Rundeck · Rundeck

Paul Calabro + 1 · Published 2022-05-20 · Updated 2022-06-08 · CVE-2022-29186

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Rundeck versions 4.0 and earlier

Description Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id rsa.pub public key of the keypair was copied to authorized keys files on remote hosts, those hosts would allow access to anyone with the exposed private credentials. This misconfiguration only impacts Rundeck Docker instances, not Debian, RPM or .WAR. A patch on Rundeck's main branch has removed the pre-generated SSH key pair, but it does not remove exposed keys that have been configured.

Recommendations To patch, users must run a script on hosts in their environment to search for exposed keys and rotate them. Do not use any pre-existing public key file from the Rundeck docker images to allow SSH access by adding it to authorized keys files. If you have copied the public key file included in the docker image, remove it from any authorized keys files.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

CVE-2022-29186

GHSA-QXJX-XR2M-HGQX

Affected Products

Rundeck

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/29xxx/CVE-2022-29186.json · Exploit
• https://github.com/rundeck/rundeck/commit/16ef7a70b202492f9fbb54d8af4bb8ea0afa10ad · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29186 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29186 · Vendor Advisory
• https://github.com/rundeck/rundeck/security/advisories/GHSA-qxjx-xr2m-hgqx · Note
• https://t.me/cibsecurity/43089 · Telegram Post