Apache SkyWalking Horizon UI is an advanced user interface for observing and monitoring distributed systems. It is utilized by developers and system administrators to track performance and diagnose issues in microservices and cloud-native applications. The software supports various systems and environments, making it widely applicable in different organizational infrastructures. Known for its rich visualization and analysis features, it helps teams maintain system health and optimize performance. By incorporating customizable dashboards, it allows users to gain insights into real-time metrics and logs seamlessly. The tool is key for operations teams looking to enhance system uptime and reliability.
This scanner detects default login credentials present in the Apache SkyWalking Horizon UI. Default logins are often left unchanged, posing security risks as they provide unauthorized users easy access to the system. The vulnerability lies in the potential misuse of standard credentials which, if discovered by a malicious actor, could lead to unauthorized access. Detecting such configurations helps organizations bolster their security postures by identifying weak spots in their access controls. The detection process checks for standard username and password combinations typically used within the application. This is crucial for preventing unauthorized operational changes that could affect system stability.
The scanner operates by attempting to authenticate to the UI using a known default username and password combination. Specifically, it tests the endpoint '/api/auth/login' with the credentials 'skywalking/skywalking'. If the application returns a successful HTTP 200 status code, and specific user attributes in the response, it indicates the presence of default credentials. Utilizing HTTP POST requests, the scanner evaluates the login mechanism to identify improperly configured or unused login defenses. The vulnerability is detected based on matching certain response strings which confirm authentication and roles presence.
If exploited, this vulnerability could allow unauthorized users to gain access to the application's administrative interface. This access might lead to data exposure, unauthorized configuration changes, and potential sabotage of system monitoring capabilities. Critical performance data and sensitive system metrics could become accessible to external parties. Moreover, the unauthorized use could also serve as a gateway to launching further attacks against the infrastructure. Detecting and addressing these issues promptly is vital to maintaining system integrity and trust.
REFERENCES
Remediation:
- Change the default username and password immediately after installation to custom credentials.
- Implement multifactor authentication to add an additional layer of security to the login process.
- Regularly audit and update credentials, ensuring they comply with security policies.
- Monitor login attempts and flag any suspicious activity automatically for investigation.
- Educate administrators and users on the importance of secure credentials management.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →