[Security] hardcoded password Harness@123 for every gitspace user account

Summary

Every Gitspace container user account gets the hardcoded password "Harness@123" as its Linux login password. The user-configured secret reference is ignored, so the value cannot be rotated; anyone who can reach the Gitspace SSH/IDE endpoint and knows the public source code can log in as the Gitspace owner.

Details

app/gitspace/secret/password_resolver.go:26,35:

const defaultPassword = "Harness@123"

func (p *PasswordResolver) Resolve(_ context.Context, _ ResolutionContext) (ResolvedSecret, error) {
	return ResolvedSecret{ SecretValue: defaultPassword }, nil
}

Resolve discards the whole ResolutionContext, including SecretRef (app/gitspace/orchestrator/utils/secret.go passes *config.GitspaceInstance.AccessKeyRef, which is never read). app/gitspace/secret/wire.go registers exactly this one resolver, so every password-type resolution returns the constant. orchestrator_resume.go stores it as gitspaceInstance.AccessKey, and app/gitspace/orchestrator/utils/script_templates/manage_user.sh runs:

echo "$username:$accessKey" | chpasswd

inside the Gitspace container. The constant ships in the public repository and every release binary/image.

Found by my Go static analyzer (taint analysis), exact report line on current main:

app/gitspace/secret/password_resolver.go:35:14: [hardcoded-credentials] hardcoded credential assigned to field "SecretValue" (confidence: 8.0/10, CWE-798)

PoC

The test calls the real resolver.

In-package test against that commit. Create poc_password_test.go in the repo:

package secret

// PoC: hardcoded credential in PasswordResolver (password_resolver.go:35).
// Every gitspace password resolution returns the public constant
// "Harness@123" and ignores the configured SecretRef.
// Run: go test ./app/gitspace/secret/ -run TestPocHardcodedPassword -v

import (
	"context"
	"testing"
)

func TestPocHardcodedPassword(t *testing.T) {
	resolved, err := (&PasswordResolver{}).Resolve(context.Background(), ResolutionContext{
		UserIdentifier:     "victim",
		GitspaceIdentifier: "gs-1",
		SecretRef:          "my-configured-secret-ref",
		SpaceIdentifier:    "space1",
	})
	if err != nil {
		t.Fatal(err)
	}
	t.Logf("Resolve(SecretRef=%q) = %q", "my-configured-secret-ref", resolved.SecretValue)
	if resolved.SecretValue != "Harness@123" {
		t.Fatalf("expected the shipped constant, got %q", resolved.SecretValue)
	}
}

Run go test ./app/gitspace/secret/ -run TestPocHardcodedPassword -v.

Verified output:

poc_password_test.go:23: Resolve(SecretRef="my-configured-secret-ref") = "Harness@123"
--- PASS: TestPocHardcodedPassword

Impact

CWE-798 hardcoded credential. The attacker gets the victim's full Gitspace environment: source tree, mounted git credentials and tokens, and the network position of the build sandbox. Requires reachability of the Gitspace endpoint (they are exposed on host ports) and the username; no per-instance secret exists to stop guessing since the value is universal and public.

CVSS: 8.1 / CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CWE IDs: CWE-798, CWE-259

Internal Tracking ID: KF-202698205