Default Password in Diem Project Configuration

Executive Summary

This vulnerability involves a default password issue in the Diem project. When setting up the system without providing a database password, it automatically creates a super-administrator account with the username 'admin' and password 'admin'. Attackers can exploit this by remotely accessing internet-exposed installations using these default credentials to gain full administrative control.

Useful 0 Not Useful 0

Detection Guidance

Check for admin accounts with default credentials by inspecting database configurations and login logs. Look for accounts with username 'admin' and password 'admin' in your Diem project installation. Verify if the database password was left empty during setup.

Useful 0 Not Useful 0

Impact Analysis

If you use the Diem project and installed it without setting a database password, attackers could gain complete control over your system. This includes managing users, modifying content, changing configurations, and performing other administrative actions without authorization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR and HIPAA. It may result in unauthorized exposure or alteration of sensitive data, leading to legal penalties, loss of trust, and potential regulatory fines.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately change the default admin password to a strong, unique one. Ensure all database passwords are set and not empty. Review and update configuration settings to disable default credentials. Restrict administrative access to trusted IPs only.

Useful 0 Not Useful 0