-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/harvester/harvester-installer | go | >= 1.6.0, <= 1.6.1 | |
| github.com/harvester/harvester-installer | go | >= 1.5.0, <= 1.5.2 |
Miggo AIRoot Cause AnalysisThe vulnerability is a critical logic flaw in the Harvester interactive installer's workflow. The installer would activate the host's networking services before forcing the user to change the default operating system password. This created a time window during installation where an attacker on the local network could gain remote shell access (SSH) using the default, well-known credentials.
The analysis of the patches between the last vulnerable version (v1.6.1) and the first fixed version (v1.7.0) revealed commit 69020d8444b0aef838ceea60a21334e5e500d60e, which explicitly refactors the installer's UI navigation.
The core of the fix involves reordering the installation steps. The functions console.addAskCreatePanel and console.addAskRolePanel, which control the initial installation path, were modified to direct the user to a password change screen (showPasswordPage) immediately after the initial setup choice. Previously, they would proceed to disk and network configuration first. This change ensures that the default password is changed before the host becomes accessible over the network, effectively closing the vulnerability window. The console.passwordWrapper.passwordConfirmVKeyEnter function was also updated to apply the password change immediately and continue the new, secure installation flow.
console.addAskCreatePanelpkg/console/install_panels.go
console.addAskRolePanelpkg/console/install_panels.go
console.passwordWrapper.passwordConfirmVKeyEnterpkg/console/helper.go
A Semantic Attack on Google Gemini - Read the Latest Research