bugtraq - Puppet Dashboard insecure by default

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 15 Feb 2012 10:30:30 -0600
From: "Schweiss, Chip" <chip@...ovates.com>
To: bugtraq <bugtraq@...urityfocus.com>
Subject: Puppet Dashboard insecure by default

Apparently, leaving all security up to the end user is okay with Puppet Labs.

I stumbled across some rather alarming search results when looking for
an explanation to a message on my own dashboard:

http://goo.gl/m99l6

There are numerous Puppet Dashboard's exposed directly to the Internet
and indexed by Google.  By default Dashboard runs on port 3000, so
these are only sites that have reconfigured to run on port 80.  A
machine search for port 3000 would probably reveal magnitudes more
sites.

This problem effects all versions of Puppet Dashboard.

When I reported this as a problem to Puppet Labs, their response was
also alarming:

"I'm sorry it took so long to get back to you.  We definitely don't
recommend people put their Dashboards on public internet, but it's not
a code level security problem for us.  I have instructed to docs
people here to update to reflect the recommendation more strongly."

Puppet Dashboard is wide open by default, has no built in security.
There is no reason the Puppet Dashboard should even be wide open on a
LAN as it will reveal all the details of every node configuration
managed by Puppet.

The workaround is straight forward, lock down the access to your
Puppet Dashboard and don't run it as installed by default and
definitely don't expose it to the Internet.