Cloud security is always crucial, but sometimes even the most trusted tools have hidden dangers. One such case is CVE-2023-1786, a vulnerability in the widely-used cloud-init package. If you’re running a version before 23.1.2, your logs might be leaking sensitive information—like hashed passwords. In the wrong hands, this data could enable an attacker to escalate their privileges or gain unauthorized access.

In this post, we’ll break down what happened, demonstrate the issue, and give you clear steps to stay safe. Ready? Let’s dive in.

What is Cloud-Init?

Cloud-init automates the initialization of cloud instances. It can set up users, configure SSH keys, network info, and set passwords (even hashed). It’s the “first-boot helper” behind countless Linux servers on AWS, Azure, GCP, and beyond.

What Went Wrong: CVE-2023-1786 Overview

Between versions 22.4 and 23.1.2, cloud-init could—under certain configs—write sensitive metadata, including hashed passwords, into system logs. An attacker with access to these logs could try to crack the hashes and gain real privileges.

Summary:

Here’s a simplified look at a snippet from the affected area (for illustration only)

# cloudinit/config/cc_set_passwords.py

def handle_password(user_data):
    hashed_pw = hash_password(user_data['password'])
    logger.info(f"Setting password to {hashed_pw!r}")  # <--- BAD! Writes the hash to the logs
    # ...rest of code setting the password...

In real code, when users give password info (even as a hash), cloud-init might log the hashed value directly to /var/log/cloud-init.log. If your passwords config came from user data or metadata service and logs were not secured, anyone with log access could grab the hash.

Let’s say you used this cloud-config on your instance

#cloud-config
users:
  - name: alice
    passwd: $6$salt$somelonghashedpwstring
    lock_passwd: false

Normally, this sets up an account “alice” with a hashed password. But if you’re running a vulnerable version, /var/log/cloud-init.log could contain lines like this:

2023-03-24 10:00:12,123 - cloud-init[INFO]: Setting password to '$6$salt$somelonghashedpwstring'

Anyone who reads the log now has access to the hash and can try to crack it offline.

Why Does This Matter?

- Hashes are not secrets: Modern attack tools (like Hashcat or John the Ripper) can crack weak hashes, especially if the password is simple.
- Privilege escalation: If an attacker gets to “alice”, they might escalate (via sudo, exploiting other misconfigs, etc.)
- Logs stick around: Even after a reboot or password change, those logs might still be on disk or copied to a centralized logging service.

Any distribution running cloud-init before version 23.1.2

- Most “big” clouds (AWS, Azure, OpenStack, GCP) could be impacted depending on auto-provisioning setups

`sh

sudo grep 'Setting password' /var/log/cloud-init.log

The Fix

The issue is patched in cloud-init version 23.1.2. The commit can be seen here.

sudo apt update && sudo apt install cloud-init


- Scrub your logs: After upgrading, clear or securely archive /var/log/cloud-init.log and any related logs.

- Prevent future leaks: Review configurations. Set logs to be accessible only by root, and avoid putting sensitive data into config files.

---

## Exploiting the Vulnerability (Proof-of-Concept)

Suppose an attacker has access to your logs:

sh
grep 'Setting password' /var/log/cloud-init.log | awk '{print $NF}' > hashes.txt


Now, use a password cracking tool:

sh
john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
`

If a simple password was used, cracking it might take seconds.

Remember: This is only possible if you’re running a vulnerable version *and* someone has access to your logs.

---

## References & Further Reading

- Official CVE record
- cloud-init upstream fix commit
- Launchpad bug report
- cloud-init project site

---

## Summary & Best Practices

- If you use cloud-init, upgrade NOW.
- Scrub logs for exposed hashes.
- Use unique and strong passwords, even if hashed.
- Lock down log permissions.

Stay safe, and keep an eye on third-party logs—sometimes, that’s where the real secrets leak out.

---

*Exclusive post by AI. If you found this helpful, share it with any sysadmin or cloud engineer you know who relies on cloud-init!*

Timeline

Published on: 04/26/2023 23:15:00 UTC
Last modified on: 05/08/2023 18:38:00 UTC