Description

(Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's return value and unconditionally accepts the result. If mkpasswd fails to generate a yescrypt hash, for example because an incompatible mkpasswd implementation or an environment without yescrypt support is used, the resulting password hash variable can be empty and the build proceeds. The resulting image can therefore contain empty password fields for the root and alpha accounts, potentially permitting passwordless authentication depending on the authentication configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.9",
  "pubDate": "2026-09-04T13:20:11.760Z",
  "pubdate": "2026-09-04T13:20:11.760Z",
  "executiveSummary": "Actualizer version 1.2.0 and earlier contains a critical security flaw involving improper password validation logic within the installation routine.\nThe vulnerability is classified as a fail-open condition where the system defaults to an insecure state if the password hashing process fails.\nSpecifically, the shell script Shell/debian-minbase-install.sh fails to validate the exit status of the mkpasswd utility used to generate yescrypt hashes.\nIf mkpasswd encounters an error or is unsupported within the build environment, the resulting password hash variable is left empty, and the script proceeds without halting.\nThis creates an image with null passwords for the root and alpha user accounts.\nAn attacker can exploit this condition to gain unauthorized access to the affected system via passwordless authentication, bypassing all intended account security controls.\nThe impact is total system compromise, as the vulnerability provides unauthenticated access to high-privilege accounts, permitting immediate escalation to root privileges.\nNo specific user interaction is required for exploitation once the system is deployed; however, the vulnerability is dependent on the initial build environment configuration failing to support the intended hashing algorithm.",
  "technicalDetails": "The vulnerability resides in the Shell/debian-minbase-install.sh script within the Actualizer build system, specifically affecting the loops responsible for defining credentials for the alpha and root user accounts.\nThe root cause is an insecure implementation of command execution and return value verification. The installer invokes the mkpasswd utility to generate a cryptographic hash (yescrypt) for the respective user account passwords.\nThe logic assumes that mkpasswd will consistently return a successful output; however, it lacks an error-handling mechanism or a conditional check on the exit status of the command. In environments where the mkpasswd implementation is incompatible, missing, or lacks yescrypt support, the command execution fails.\nInstead of terminating the build process or throwing an exception, the script assigns the empty result of the failed command to the password hash variable and proceeds with image generation.\nThe resulting filesystem image is then populated with empty password fields for the affected accounts in /etc/shadow or equivalent authentication files.\nThe attack flow proceeds as follows: 1) The build system invokes an environment incapable of executing mkpasswd as intended. 2) The installer script attempts to generate password hashes. 3) mkpasswd fails, returning an empty string. 4) The installer fails to detect the failure and treats the empty string as a valid hash. 5) The final deployment image is generated with blank passwords for root and alpha. 6) A local or remote actor attempts authentication against the image. 7) Because the shadow file contains an empty password entry for the target account, the authentication subsystem grants access without requiring a password or utilizing secondary credentials.\nThis vulnerability effectively disables local access controls, allowing an attacker to log in as root or the alpha user without any prerequisite knowledge of a password. Post-exploitation impact is severe, granting the attacker a persistent foothold with full administrative control over the underlying system, enabling arbitrary code execution, lateral movement, or data exfiltration.\nThe flaw affects Actualizer v1.2.0 and all prior versions that utilize the vulnerable shell script installation logic."
}