CVE-2022-29186 Explained : Impact and Mitigation

Rundeck, an open-source automation service, was found to have a critical vulnerability involving the use of a hard-coded cryptographic key. This flaw could allow unauthorized access to remote hosts, compromising confidentiality and integrity.

Understanding CVE-2022-29186

This CVE pertains to the presence of a pre-generated SSH keypair in Rundeck Docker images, exposing systems to security risks.

What is CVE-2022-29186?

Rundeck Docker instances of PagerDuty® Process Automation On Prem (formerly Rundeck) version 4.0 and earlier were impacted by a vulnerability that could lead to unauthorized access if SSH keys were exposed.

The Impact of CVE-2022-29186

The vulnerability poses a critical threat with a CVSS base score of 9.1, affecting confidentiality and integrity.

Technical Details of CVE-2022-29186

The vulnerability stems from the use of a hard-coded cryptographic key in Rundeck's Docker images.

Vulnerability Description

Rundeck community and rundeck-enterprise Docker images contained a pre-generated SSH keypair, potentially allowing unauthorized access to hosts.

Affected Systems and Versions

Versions of Rundeck up to and including 4.2.1 are affected by this vulnerability.

Exploitation Mechanism

Copying the id_rsa.pub public key of the keypair to authorized_keys files on remote hosts could grant access to unauthorized users.

Mitigation and Prevention

To address CVE-2022-29186, users must take immediate steps to secure their systems and prevent unauthorized access.

Immediate Steps to Take

Run a script on hosts to search for exposed keys and rotate them. Avoid using pre-existing public key files from Rundeck Docker images for SSH access.

Long-Term Security Practices

Regularly review and update SSH configurations, implement access controls, and conduct security audits to prevent similar vulnerabilities.

Patching and Updates

Rundeck's

main

branch has removed the pre-generated SSH key pair, but exposed keys that have been configured must be manually removed for security.