Port 8096 allows unauthenticated access from any IP. #3450

ISSUE TYPE

• Bug Report

COMPONENT NAME

API

CLOUDSTACK VERSION

master

CONFIGURATION

OS / ENVIRONMENT

SUMMARY

CloudStack provides CloudStack API Unauthenticated Access through port 8096. It should not be open to the Internet in any case. If this port is not properly blocked by a firewall it could be really serious.

STEPS TO REPRODUCE

Using 8080:
http://:8080/client/api?command=listClusters&response=json&listAll=true&page=1&pagesize=20&_=1556128046728

{"listclustersresponse":{"uuidList":[],"errorcode":401,"errortext":"unable to verify user credentials and/or request signature"}}

Using 8096:
http://:8096/client/api?command=listClusters&response=json&listAll=true&page=1&pagesize=20&_=1556128046728

listed all clusters of the zone

EXPECTED RESULTS

curl: (7) Failed to connect to <acs-environment> port 8096: Connection refused
[1]   Exit 7                  curl http://<acs-environment>:8096/client/api?command=listClusters

ACTUAL RESULTS

listed all clusters of the zone

FIX proposal

I have implemented a fix that binds the port 8096 with the loopback address (127.0.0.1). Tested and so far it looks all right. Still need to open a PR.