Skip to content

Conversation

ThiagoCruzBr
Copy link
Contributor

Alternative command useful for automation.

Alternative command useful for automation.
Copy link

dryrunsecurity bot commented Aug 5, 2025

DryRun Security

This pull request contains a documentation issue where a hardcoded weak password ('Password123!') is included in the Docker setup instructions, which could potentially lead to security risks if users directly copy and paste the example command without changing the password.

Hardcoded Weak Password in Documentation in readme-docs/DOCKER.md
Vulnerability Hardcoded Weak Password in Documentation
Description The documentation file readme-docs/DOCKER.md contains an example command for changing the admin password that includes a hardcoded, weak password ('Password123!'). This command is presented as an alternative for automation, implying it's intended for users setting up their instances. Users are highly likely to copy and paste this command, which could lead to production systems having a known, easily guessable administrator password, thereby creating a significant security vulnerability.

docker compose exec -it uwsgi ./manage.py changepassword admin
```
Alternatively, you can run the command below to change the admin password in a single command. Useful for automation.
```zsh
docker compose exec uwsgi ./manage.py shell -c 'from django.contrib.auth.models import User; u = User.objects.get(username="admin"); u.set_password("Password123!"); u.save()'
```
# Logging
For docker compose release mode the log level is INFO. In the other modes the log level is DEBUG. Logging is configured in `settings.dist.py` and can be tuned using a `local_settings.py`, see [template for local_settings.py](../dojo/settings/template-local_settings)). For example the deduplication logger can be set to DEBUG in a local_settings.py file:


All finding details can be found in the DryRun Security Dashboard.

@Maffooch Maffooch requested review from dogboat and blakeaowens August 7, 2025 06:23
Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@mtesauro mtesauro merged commit 0ca79ab into DefectDojo:bugfix Aug 9, 2025
85 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants