3CX users password automatically changed if 18.0.7 @18.0.8 update fails

[Guillaume Bourgeois]

I had a failed update from 18.0.7 to 18.0.8.
Ok, I looked at the logs, I understand the problem. I will be able to correct it... but it has a behavior which I consider problematic..

A security mechanism seems to be in place to return (downgrade) to 18.0.7 but ... all passwords (login passwords --> WebClient/Dashboard) are replaced by " password " !



@3cx team
Is this the behavior really desired?

Isn't that a high security risk?
I see more and more users getting their WebClient hacked.. doesn't that increase the risks?



thx

debconf: Impossible d'initialiser l'interface : Dialog
debconf: (L'interface dialog ne fonctionnera pas avec un terminal rustique (« dumb »), un tampon shell d'Emacs ou sans terminal de contrôle.)
debconf: Utilisation de l'interface Readline en remplacement
debconf: Impossible d'initialiser l'interface : Readline
debconf: (Cette interface a besoin d'un terminal de contrôle.)
debconf: Utilisation de l'interface Teletype en remplacement
dpkg-preconfigure: impossible de réouvrir stdin :
0 mis à jour, 0 nouvellement installés, 1 remis à une version inférieure, 0 à enlever et 8 non mis à jour.
1 partiellement installés ou enlevés.
Il est nécessaire de prendre 0 o/119 Mo dans les archives.
Après cette opération, 9 499 ko d'espace disque seront libérés.
dpkg: avertissement: dégradation (« downgrade ») de 3cxpbx depuis 18.0.8.917 vers 18.0.7.312

 

[Evolute IT]

@Agathocles Prodromou

 

[Agathocles Prodromou]

Hi,

The passwords in >=U7 .424 are hashed. In any case you shouldn’t be downgrading, especially between major versions. You should be restoring from a a backup/snapshot.

 

[Evolute IT]

Hi,

The passwords in >=U7 .424 are hashed. In any case you shouldn’t be downgrading, especially between major versions. You should be restoring from a a backup/snapshot.

The update failed, and auto-reverted, which caused this.

 

[Guillaume Bourgeois]

Hi,

The passwords in >=U7 .424 are hashed. In any case you shouldn’t be downgrading, especially between major versions. You should be restoring from a a backup/snapshot.

It's not me who downgrades it;
it's the 3CX update.
When it fails, it reverts back to the working version and send me "failing" log by email ..

I have copied you on a snippet of the log received by email.

 

[Guillaume Bourgeois]

The update failed, and auto-reverted, which caused this.

Yes exactly

 

[Charles_3CX]

Hi Guillaume, can you open a ticket with us at 3cx technical support so that we can request and check the logging after the system tries to update and fails, then reverts to the previous version?

The fact that the system fails to update, though, can also be checked.

 

[Guillaume Bourgeois]

The fact that the system fails to update, though, can also be checked.

The reason for the update failure has already been fix and all user passwords have been re-changed.

The intent behind my post is to report the sequence of events that occur after a failure, not the failure itself.

The behavior of reverting back is common when an update fails; it's actually the intended behavior when an update fails if is initiated from the 3CX Dashboard, whether automatically or manually.

To clarify, my aim is not to identify the root cause of the failure. Rather, I'm highlighting the specific behavior that occurs when a failure happens—namely, the resetting of everyone's Dashboard and WebClient passwords to the " password " word. This behavior is undoubtedly directly related to what was described by @Agathocles Prodromou .

We have several 3CX PBXs that have encountered this behavior after an update failure. Although this no longer concerns me, as the outage scenarios have been fixed, I wanted to alert the community and your team to this high security risk behavior. At the very least, I wanted to warn others to change passwords on update failure to something more secure than : "password" ... that might be easy hack.

Hi @Guillaume, can you open a ticket with us at 3cx technical support

We do not need technical assistance for this situation, but if you wish that I open a ticket to allow you to investigate, I will be happy to collaborate.

That said, here are the logs received by email, it contains nothing "confidential".



Sincerely,