T09 · Insecure Skill Coding Practices
- Location
references/doc_2337.md:1164- Finding
Predictable Administrative Credentials in Cluster Replication Configuration
- Content
View full analysis
Vulnerability Details
File Location:
references/doc_2337.md:1164-1171
Vulnerability Type: Hard-coded predictable administrative credentials
Risk Level: HighVulnerable Code:
text clusterReplicationExecutionUsername=admin Used to execute inter-cluster asynchronous replication. The default is admin. clusterReplicationExecutionPassword=123456 Used as the password for inter-cluster asynchronous replication. The default is 123456.Technical Analysis
The documentation presents a privileged replication account with the predictable username
adminand password123456. The replication identity requires transaction-related permissions and can therefore perform security-sensitive operations against replicated databases.Although this content is documentation rather than automatically executed code, users or AI agents may reproduce the configuration verbatim. A publicly known default password provides no meaningful protection against credential guessing. The documentation notes that newer releases use RSA authentication, but the insecure credential remains applicable to configurations or versions that use the password parameter.
Attack Path
- An administrator or AI agent copies the documented replication configuration.
- The administrator does not replace the example password.
- An attacker identifies a reachable DolphinDB node through network scanning, leaked configuration, or infrastructure knowledge.
- The attacker attempts authentication with the documented
adminand123456credentials. - If accepted, the attacker obtains the transaction and replication privileges assigned to the replication account.
- The attacker can access, alter, or interfere with data available through that account.
Impact Assessment
Successful exploitation can grant privileged database access, including transaction execution and interference with inter-cluster replication. Depending on the pe ...[truncated 381 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace literal credentials with explicit placeholders such as
REPLICATION_USERandREPLICATION_PASSWORD_FROM_SECRET_MANAGER. - State prominently that examples must never use default or shared administrative credentials.
- Require a dedicated replication account with only the minimum transaction and database permissions needed for replication.
- Prefer the RSA-based authentication mechanism documented for DolphinDB 3.00.1 and later.
- Generate unique, high-entropy credentials for deployments that still require password authentication.
- Store credentials in a protected secret manager or encrypted configuration facility rather than source-controlled files.
- Restrict replication ports to explicitly authorized cluster nodes using host firewalls and network access controls.
- Rotate any existing deployment that uses
adminand123456, and review authentication logs for prior use.
- Replace literal credentials with explicit placeholders such as