VPS.org templates ship default database passwords
VPS.org's one-click Supabase and Zulip deployment templates use hard-coded passwords and secrets, allowing remote database or account takeover.
CERT/CC disclosed two vulnerabilities in VPS.org's one-click deployment templates that provision cloud services with static, hard-coded credentials instead of generating unique secrets per deployment. The Supabase template exposes PostgreSQL on all network interfaces with the default password 'postgres', potentially bypassing host firewall rules due to Docker's own iptables management. The Zulip template ships with a publicly known application secret key ('changeme'), a default database password, and HTTPS disabled by default, enabling session forgery, authentication bypass, and cleartext credential interception.
Both issues stem from the same root design flaw: templates are instantiated directly from static configuration files without deployment-specific randomization or network hardening at provisioning time. CERT/CC rates the technical impact as Total under SSVC, since successful exploitation can grant full database or application control, including data exfiltration, schema modification, persistence, and account takeover.
VPS.org could not be reached to coordinate disclosure and no patch is currently available. Users deploying these templates are urged to immediately change default passwords and secret keys, restrict network exposure of backend services via firewall/segmentation, and enable HTTPS before any production use.
Mentioned in this report
Detection guidance
Container Deployment Command Using Known Default Template Credentials
Detects docker run/compose invocations that set the publicly documented default credential strings from VPS.org's Supabase/Zulip templates (POSTGRES_PASSWORD=postgres, SECRET_KEY=changeme), indicating a deployment that never rotated static secrets baked into the template. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Container Deployment Command Using Known Default Template Credentials
description: Detects docker run/create or docker-compose invocations passing the disclosed
default secrets ('postgres' password, 'changeme' secret key) shipped in VPS.org
one-click templates. Presence of these literal values in provisioning commands means
the deployment inherited hard-coded credentials instead of generating unique secrets.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: process_creation
product: linux
detection:
selection_tool:
Image|endswith:
- /docker
- /docker-compose
selection_cred:
CommandLine|contains:
- POSTGRES_PASSWORD=postgres
- SECRET_KEY=changeme
condition: selection_tool and selection_cred
falsepositives:
- Local development or CI test environments intentionally using template defaults
before hardening
- Documentation/tutorial scripts that echo the sample values without actually deploying
them
level: medium
id: f4fd7eff-2b0e-5245-8a2c-d24e60fbe523
status: experimental
author: Vorant
Inbound Connection to Externally Exposed Default-Credential PostgreSQL Port
Detects non-local network connections to the default PostgreSQL port (5432) on a host, consistent with the Supabase template's behavior of binding Postgres to all interfaces with the unrotated default 'postgres' password, allowing remote valid-account style access without exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inbound Connection to Externally Exposed Default-Credential PostgreSQL Port
description: Detects inbound network connections to TCP/5432 (PostgreSQL) originating
from a non-loopback, non-RFC1918 source. VPS.org's Supabase template binds Postgres
to 0.0.0.0 with the default 'postgres' password and can bypass host firewall rules
via Docker's own iptables management, so any externally sourced connection to this
port on such a host represents a valid-account logon opportunity using unrotated
credentials.
tags:
- attack.initial-access
- attack.t1078
logsource:
category: network_connection
product: linux
detection:
selection:
DestinationPort: 5432
filter_internal:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
condition: selection and not filter_internal
falsepositives:
- Legitimate external application servers or managed database clients that are intentionally
allow-listed to reach this Postgres instance
- Load balancers or bastion hosts performing health checks against the database port
from public IP space
level: medium
id: 75382880-d7e8-5c03-8eb3-fbc18c725a68
status: experimental
author: Vorant
Cleartext HTTP Authentication Traffic to Zulip Login Endpoint
Detects plaintext HTTP (not HTTPS) requests to Zulip's authentication endpoints, matching the template's default configuration of HTTPS disabled, which allows credentials and session tokens to be intercepted by network sniffing. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cleartext HTTP Authentication Traffic to Zulip Login Endpoint
description: Detects HTTP (port 80, non-TLS) requests to Zulip's account/login or
API authentication paths. The VPS.org Zulip template ships with HTTPS disabled by
default, so authentication and session cookies traverse the network in cleartext
and are exposed to passive network sniffing.
tags:
- attack.credential-access
- attack.t1040
logsource:
category: proxy
product: zeek
detection:
selection:
dest_port: 80
c-uri|contains:
- /accounts/login
- /api/v1/fetch_api_key
condition: selection
falsepositives:
- Reverse proxies that legitimately terminate TLS upstream and forward decrypted traffic
internally over port 80
- Health-check or status endpoints incidentally matching the login path pattern
level: low
id: 8acd13ad-0e0a-5e7a-a556-e22603f23369
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/243636
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free