Couchbase use a password on the commandline

[Tristan Cacqueray]

Reported via private E-mail from Michael Scherer

Couchbase use a password on the commandline, so it might be seen by
other users and/or end in log file ( there is some sanitization, but not
sure how/where ).
https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/backup/experimental/couchbase_impl.py#L58

It use it also for restore the same file :
https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/restore/experimental/couchbase_impl.py#L88

[Tristan Cacqueray (tristan-cacqueray)]

Since this report concerns a possible security risk, an incomplete security advisory task has been added while the core security reviewers for the affected project or projects confirm the bug and discuss the scope of any vulnerability along with potential solutions.

[Thierry Carrez (ttx)]

We should doublecheck the log aspect -- but otherwise since there are no local users on a Trove node, unless there is a SQL command that lets you read the process table, that should be pretty shallow.

[Tristan Cacqueray (tristan-cacqueray)]

I couldn't get a cassandra datastore to try to reproduce that bug.

Nikhil, can you check whenever a user is able to control the password value and when the command fail, does it leaks in logs ?

[Nikhil Manchanda (slicknik)]

Will check this out in a Couchbase env and get more details.

[Tristan Cacqueray (tristan-cacqueray)]

Nikhil, any progress ?

[Nikhil Manchanda (slicknik)]

I spun up a couchbase instance and took a backup, and was able to repro this.

 The password is not leaked in any of the service logs (i.e. trove api, taskmanager, or conductor) but it _is_ leaked in the trove-guestagent log. The guest-instance (as Thierry mentions above) is not accessible to users, so this is somewhat mitigated -- but I'd like to have this fixed in the guest-agent as hardening, so that we don't end up with the password in the log.

Thanks,
Nikhil

[Tristan Cacqueray (tristan-cacqueray)]

Thanks for the debunking, so this is a class C1 type of bug ( https://security.openstack.org/vmt-process.html#incident-report-taxonomy ).

[Tristan Cacqueray (tristan-cacqueray)]

Just removed the CVE reference since it is being rejected by CNA.

[Amrith Kumar (amrith)]

Nikhil, any update on this?

[Amrith Kumar (amrith)]

This is not an issue any longer as log messages are scrubbed with mask_passwords.