Skip to content

SSH key pairs are very buggy #12925

@Matrix89

Description

@Matrix89

problem

Having the ssh key pairs being identified by their name leads to a lot of weird issues.

  1. The key pair validator allows commas(and other special characters like an ampersand) in the key pair name.
  2. The deployVirtualMachine command keypairs parameter isn't escaped, this breaks on key pairs containing commas.
  3. The deployVirtualMachine command keypair works with commas
  4. The UI breaks when a key pair contains commas, below is a single key containing a bunch of commas Image
  5. If the API consumer assumes the key pair name is safe and validated by cloudstack it cloud lead to a command injection(but it requires a lot of wrong assumptions)

versions

CloudStack 4.22.0.0

The steps to reproduce the bug

You can use the UI to observe most of the issues:

  1. Create a new key pair with a comma in the name eg. test, test
  2. Try creating a new instance with said key

What to do about it?

  1. Add a new keypairId array parameter to all the endpoint which access key pair name.
  2. Mark the keypair and keypairs parameters deprecated.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions