CVE-2023-41878 (published 2023-09-27T15:19Z)

MeterSphere is a one-stop open source continuous testing platform, covering functions such as test tracking, interface testing, UI testing and performance testing. The Selenium VNC config used in Metersphere is using a weak password by default, attackers can login to vnc and obtain high permissions. This issue has been addressed in version 2.10.7 LTS. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-798
cwe_name: Use of Hard-coded Credentials
description: The product contains hard-coded credentials, such as a password or cryptographic key.
extended_description: 
		   There are two main variations:
		   
			 Inbound: the product contains an authentication mechanism that checks the input credentials against a hard-coded set of credentials. In this variant, a default administration account is created, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each installation of the product, and it usually cannot be changed or disabled by system administrators without manually modifying the program, or otherwise patching the product. It can also be difficult for the administrator to detect.
			 Outbound: the product connects to another system or component, and it contains hard-coded credentials for connecting to that component. This variant applies to front-end systems that authenticate with a back-end service. The back-end service may require a fixed password that can be easily discovered. The programmer may simply hard-code those back-end credentials into the front-end product.
		   
         
         

Fix information:
repo_url: https://github.com/metersphere/installer
commit_details: repo_url: https://github.com/metersphere/installer
author: liqiang-fit2cloud
author_date: 2023-09-11 09:34:24+08:00
msg: fix: 修复selenium弱密码的问题

默认禁用vnc，默认vnc为只读模式，缺省弱密码改为强密码。
用户可以手动开启vnc，开启后可以指定是否只读，并修改vnc密码。
参考：
https://github.com/SeleniumHQ/docker-selenium#debugging
https://github.com/SeleniumHQ/docker-selenium#disabling-vnc
repository: repo_url: https://github.com/metersphere/installer
repo_name: metersphere/installer
repo_language: Shell
owner: metersphere
file_changes: filename: docker-compose-seleniarm.yml
change_type: ModificationType.MODIFY
diff: @@ -5,7 +5,7 @@ services:
     container_name: selenium-chrome
     shm_size: 2gb
     ports:
-      - "5900:5900" # password: secret
+      - "5900:5900"
     depends_on:
       - selenium-hub
     entrypoint: bash -c '[ ! -f /home/seluser/language ] && sudo sed -i -e "s/# $$LANG.*/$$LANG UTF-8/" /etc/locale.gen && sudo dpkg-reconfigure --frontend=noninteractive locales && sudo update-locale LANG=$$LANG && touch /home/seluser/language; /opt/bin/entry_point.sh'
@@ -21,6 +21,9 @@ services:
       - SCREEN_HEIGHT=1080
       - LANGUAGE=zh_CN.UTF-8
       - LANG=zh_CN.UTF-8
+      - SE_START_VNC=false
+      - SE_VNC_VIEW_ONLY=1
+      - SE_VNC_PASSWORD=Password123@selenium
     restart: always
     healthcheck:
       test: ["CMD", "bash", "-c", "< /dev/tcp/localhost/5900"]
@@ -34,7 +37,7 @@ services:
     container_name: selenium-firefox
     shm_size: 2gb
     ports:
-      - "5901:5900" # password: secret
+      - "5901:5900"
     depends_on:
       - selenium-hub
     entrypoint: bash -c '[ ! -f /home/seluser/language ] && sudo sed -i -e "s/# $$LANG.*/$$LANG UTF-8/" /etc/locale.gen && sudo dpkg-reconfigure --frontend=noninteractive locales && sudo update-locale LANG=$$LANG && touch /home/seluser/language; /opt/bin/entry_point.sh'
@@ -50,6 +53,9 @@ services:
       - SCREEN_HEIGHT=1080
       - LANGUAGE=zh_CN.UTF-8
       - LANG=zh_CN.UTF-8
+      - SE_START_VNC=false
+      - SE_VNC_VIEW_ONLY=1
+      - SE_VNC_PASSWORD=Password123@selenium
     restart: always
     healthcheck:
       test: [ "CMD", "bash", "-c", "< /dev/tcp/localhost/5900" ]

programming_language: Shell