Open mrgum opened 6 months ago
A possible fix for this issue, the one I am currently using is to replace
const password = crypto
.privateDecrypt(
{ key: privateKey, padding: crypto.constants.RSA_PKCS1_PADDING },
Buffer.from(passwordData, 'base64'),
)
.toString('utf8');
with
const keyRSA = new NodeRSA(
privateKey,
"private",
{
encryptionScheme: "pkcs1",
}
)
keyRSA.setOptions({ environment: "browser" });
const decrypted = keyRSA.decrypt(Buffer.from(passwordData, "base64"), "buffer");
const password = decrypted.toString();
Adding node-rsa to the package.json and running pnpm install
where its needed
Though as this code appears four times in the codebase perhaps a utility function would be a better fix?
https://github.com/nodejs/node/issues/52017 is where I got the fix from
Release 6.2.2 fixes this bug.
release v6.2.2 fixes this for getting windows passwords, however another connection method, getRStudioUrl still uses the now broken code and needs the same fix https://github.com/awslabs/service-workbench-on-aws/blob/mainline/addons/addon-base-raas/packages/base-raas-services/lib/environment/built-in/environment-url-service.js#L61-L64 https://github.com/awslabs/service-workbench-on-aws/blob/mainline/addons/addon-base-raas/packages/base-raas-services/lib/environment/service-catalog/environment-sc-connection-service.js#L247-L250
Describe the bug After redeploying a previously working SWB we can no longer get connections to rdp workspaces
To Reproduce Steps to reproduce the behavior:
Expected behavior Get connection to workspace
Versions (please complete the following information):
Additional context Tracing through cloudwatch logs gives
in our code line 483 is the same as line 388 in the original code, the second line of
I think this is a security bug so should be dealt with despite SWB being in maintenance mode I will email a link to this issue to aws-security@amazon.com