CVE-2023-41878: Use of Hard-coded Credentials (CWE-798)
value: MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high permissions. This issue has been addressed in version 2.10.7 LTS. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: The product contains hard-coded credentials, such as a password or cryptographic key.
CVSS v3 base score: 9.8
Published: 2023-09-27T15:19Z
Repository: https://github.com/metersphere/installer
Language: YAML
Files changed: metersphere/docker-compose-seleniarm.yml
Commit date: 2023-09-11 09:34:24 +0800
Commit message: fix: 修复selenium弱密码的问题

默认禁用vnc，默认vnc为只读模式，缺省弱密码改为强密码。
用户可以手动开启vnc，开启后可以指定是否只读，并修改vnc密码。
参考：
https://github.com/SeleniumHQ/docker-selenium#debugging
https://github.com/SeleniumHQ/docker-selenium#disabling-vnc

Diff: diff --git a/metersphere/docker-compose-seleniarm.yml b/metersphere/docker-compose-seleniarm.yml
index 8279dbf..37fa1a6 100644
--- a/metersphere/docker-compose-seleniarm.yml
+++ b/metersphere/docker-compose-seleniarm.yml
@@ -3,11 +3,11 @@ services:
   chrome:
     image: ${MS_IMAGE_PREFIX}/node-chromium:4.8.3
     container_name: selenium-chrome
     shm_size: 2gb
     ports:
-      - "5900:5900" # password: secret
+      - "5900:5900"
     depends_on:
       - selenium-hub
     entrypoint: bash -c '[ ! -f /home/seluser/language ] && sudo sed -i -e "s/# $$LANG.*/$$LANG UTF-8/" /etc/locale.gen && sudo dpkg-reconfigure --frontend=noninteractive locales && sudo update-locale LANG=$$LANG && touch /home/seluser/language; /opt/bin/entry_point.sh'
     environment:
       - SE_EVENT_BUS_HOST=selenium-hub
@@ -19,10 +19,13 @@ services:
       - JAVA_OPTS=-Xmx400m -Dfile.encoding=utf-8
       - SCREEN_WIDTH=1920
       - SCREEN_HEIGHT=1080
       - LANGUAGE=zh_CN.UTF-8
       - LANG=zh_CN.UTF-8
+      - SE_START_VNC=false
+      - SE_VNC_VIEW_ONLY=1
+      - SE_VNC_PASSWORD=Password123@selenium
     restart: always
     healthcheck:
       test: ["CMD", "bash", "-c", "< /dev/tcp/localhost/5900"]
       interval: 6s
       timeout: 5s
@@ -32,11 +35,11 @@ services:
   firefox:
     image: ${MS_IMAGE_PREFIX}/node-firefox:4.8.3
     container_name: selenium-firefox
     shm_size: 2gb
     ports:
-      - "5901:5900" # password: secret
+      - "5901:5900"
     depends_on:
       - selenium-hub
     entrypoint: bash -c '[ ! -f /home/seluser/language ] && sudo sed -i -e "s/# $$LANG.*/$$LANG UTF-8/" /etc/locale.gen && sudo dpkg-reconfigure --frontend=noninteractive locales && sudo update-locale LANG=$$LANG && touch /home/seluser/language; /opt/bin/entry_point.sh'
     environment:
       - SE_EVENT_BUS_HOST=selenium-hub
@@ -48,10 +51,13 @@ services:
       - JAVA_OPTS=-Xmx400m -Dfile.encoding=utf-8
       - SCREEN_WIDTH=1920
       - SCREEN_HEIGHT=1080
       - LANGUAGE=zh_CN.UTF-8
       - LANG=zh_CN.UTF-8
+      - SE_START_VNC=false
+      - SE_VNC_VIEW_ONLY=1
+      - SE_VNC_PASSWORD=Password123@selenium
     restart: always
     healthcheck:
       test: [ "CMD", "bash", "-c", "< /dev/tcp/localhost/5900" ]
       interval: 6s
       timeout: 5s

Vulnerable code:       - "5900:5900" # password: secret
      - "5901:5900" # password: secret
Fixed code:       - "5900:5900"
      - SE_START_VNC=false
      - SE_VNC_VIEW_ONLY=1
      - SE_VNC_PASSWORD=Password123@selenium
      - "5901:5900"
      - SE_START_VNC=false
      - SE_VNC_VIEW_ONLY=1
      - SE_VNC_PASSWORD=Password123@selenium