[AAA-21] Security Issue in Restconf: Restconf config output produces user name and password in clear text

Thu, 21 Mar 2019 11:56:39 +0000

I mounted couple of Netconf capable devices onto the ODL controller. Once I did that I wanted to get the config output of the
1. Entire controller ( As controller itself can be mounted as Netconf end point)
2. The configuration of the mounted device.

For the first one I issued the following restconf URL.

http://10.18.161.79:8181/restconf/config/opendaylight-inventory:nodes/node/controller-config/yang-ext:mount/config:modules/

This resulted in some configuration information of the mounted devices including the user name and password to access them.

However the user name and password is in clear text which is a big security threat.

OpenDaylight JIRA

[AAA-21] Security Issue in Restconf: Restconf config output produces user name and password in clear text