Critical · published May 20, 2022
🚨 A pre-generated SSH keypair in Rundeck’s Docker images could hand unauthorized access on a silver platter! 🔥 Consider it like a hotel giving out a master key to every guest without realizing the implications — anyone with that key can waltz into any room! An attacker with access to the private SSH key could infiltrate any system that trusts the public counterpart, leading to potentially devastating consequences like data theft, unauthorized command execution, or worse! Imagine an intruder walking freely through your servers and wreaking havoc — that's why this is critical!
Consider it like a hotel giving out a master key to every guest without realizing the implications — anyone with that key can waltz into any room! The vulnerability arises from Rundeck Docker images pre-packaging an SSH keypair, which, if placed in authorized_keys, allows anyone with the private key to access the remote hosts. This misconfiguration primarily affects Rundeck versions 4.0 and earlier.
An attacker with access to the private SSH key could infiltrate any system that trusts the public counterpart, leading to potentially devastating consequences like data theft, unauthorized command execution, or worse! Imagine an intruder walking freely through your servers and wreaking havoc — that's why this is critical! To remediate this vulnerability, users must first run a script to search for and rotate any exposed keys in their environment. Additionally, ensure that no public key file from the Rundeck Docker image is used for SSH access by removing it from any authorized_keys files. Patch the Rundeck instances by updating to the latest version to eliminate the pre-generated keys. You've got this! Follow these steps to secure your Rundeck instances and reclaim your security hero status! 🛡️