You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The url in iframe of novnc console can be used without user login.
When open a vm console, and open the source of page, we get the real link of novnc console.
we are able to access the novnc console on other browsers/servers/ via the link, without user login.
This is a potential security issue.
We have two options
(1) add source IP of client to encrypted token, and check the client IP after token decryption when access the vm console.
we need to make sure
IP to management server and CPVM (console proxy vm) are same.
If the new browser/session has same outgoing IP as old session, it will still be able to access the vm console.
(2) save the access ticket to database
when vm console, access ticket will be generated and saved into database.
When access the console, management server will check the params to see if vm is valid and access ticket is not expired.,etc.
It will also check if token is valid and has been not used.
The url in iframe of novnc console can be used without user login.
When open a vm console, and open the source of page, we get the real link of novnc console.
we are able to access the novnc console on other browsers/servers/ via the link, without user login.
This is a potential security issue.
We have two options
(1) add source IP of client to encrypted token, and check the client IP after token decryption when access the vm console.
we need to make sure
to be clear, these two files need to be changed
https://github.com/apache/cloudstack/blob/master/server/src/main/java/com/cloud/servlet/ConsoleProxyClientParam.java
and
https://github.com/apache/cloudstack/blob/master/services/console-proxy/server/src/main/java/com/cloud/consoleproxy/ConsoleProxyClientParam.java
(2) save the access ticket to database
when vm console, access ticket will be generated and saved into database.
When access the console, management server will check the params to see if vm is valid and access ticket is not expired.,etc.
It will also check if token is valid and has been not used.
ISSUE TYPE
COMPONENT NAME
CLOUDSTACK VERSION
CONFIGURATION
OS / ENVIRONMENT
SUMMARY
STEPS TO REPRODUCE
open a vm console
example:
view the source of the page
example
It will not work at the first time, but works after refresh (related to novnc: Accept new novnc client and disconnect old session #4531 )
EXPECTED RESULTS
ACTUAL RESULTS