VPS.org templates ship default database passwords
VPS.org's one-click Supabase and Zulip deployment templates use hard-coded passwords and secrets, allowing remote database or account takeover.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC disclosed two vulnerabilities in VPS.org's one-click deployment templates that provision cloud services with static, hard-coded credentials instead of generating unique secrets per deployment. The Supabase template exposes PostgreSQL on all network interfaces with the default password 'postgres', potentially bypassing host firewall rules due to Docker's own iptables management. The Zulip template ships with a publicly known application secret key ('changeme'), a default database password, and HTTPS disabled by default, enabling session forgery, authentication bypass, and cleartext credential interception.
Both issues stem from the same root design flaw: templates are instantiated directly from static configuration files without deployment-specific randomization or network hardening at provisioning time. CERT/CC rates the technical impact as Total under SSVC, since successful exploitation can grant full database or application control, including data exfiltration, schema modification, persistence, and account takeover.
VPS.org could not be reached to coordinate disclosure and no patch is currently available. Users deploying these templates are urged to immediately change default passwords and secret keys, restrict network exposure of backend services via firewall/segmentation, and enable HTTPS before any production use.
Mentioned in this report
Detection guidance
Container Deployment Command Using Known Default Template Credentials
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects docker run/compose invocations that set the publicly documented default credential strings from VPS.org's Supabase/Zulip templates (POSTGRES_PASSWORD=postgres, SECRET_KEY=changeme), indicating a deployment that never rotated static secrets baked into the template. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Container Deployment Command Using Known Default Template Credentials
description: Detects docker run/create or docker-compose invocations passing the disclosed
default secrets ('postgres' password, 'changeme' secret key) shipped in VPS.org
one-click templates. Presence of these literal values in provisioning commands means
the deployment inherited hard-coded credentials instead of generating unique secrets.
tags:
- attack.credential-access
- attack.t1552.001
logsource:
category: process_creation
product: linux
detection:
selection_tool:
Image|endswith:
- /docker
- /docker-compose
selection_cred:
CommandLine|contains:
- POSTGRES_PASSWORD=postgres
- SECRET_KEY=changeme
condition: selection_tool and selection_cred
falsepositives:
- Local development or CI test environments intentionally using template defaults
before hardening
- Documentation/tutorial scripts that echo the sample values without actually deploying
them
level: medium
id: f4fd7eff-2b0e-5245-8a2c-d24e60fbe523
status: experimental
author: Vorant
Inbound Connection to Externally Exposed Default-Credential PostgreSQL Port
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects non-local network connections to the default PostgreSQL port (5432) on a host, consistent with the Supabase template's behavior of binding Postgres to all interfaces with the unrotated default 'postgres' password, allowing remote valid-account style access without exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inbound Connection to Externally Exposed Default-Credential PostgreSQL Port
description: Detects inbound network connections to TCP/5432 (PostgreSQL) originating
from a non-loopback, non-RFC1918 source. VPS.org's Supabase template binds Postgres
to 0.0.0.0 with the default 'postgres' password and can bypass host firewall rules
via Docker's own iptables management, so any externally sourced connection to this
port on such a host represents a valid-account logon opportunity using unrotated
credentials.
tags:
- attack.initial-access
- attack.t1078
logsource:
category: network_connection
product: linux
detection:
selection:
DestinationPort: 5432
filter_internal:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
condition: selection and not filter_internal
falsepositives:
- Legitimate external application servers or managed database clients that are intentionally
allow-listed to reach this Postgres instance
- Load balancers or bastion hosts performing health checks against the database port
from public IP space
level: medium
id: 75382880-d7e8-5c03-8eb3-fbc18c725a68
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/243636
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs