Open OnDemand Password Rotation Vulnerability in noVNC Interactive Applications

A vulnerability exists in Open OnDemand versions through 3.1.14 and 4.0.6, where noVNC interactive applications fail to properly rotate passwords when TurboVNC is used in versions higher than 3.1.2. This issue allows a user to share a link to an active desktop session, potentially letting another authenticated user perform actions and access data as the original user.

Impact

Exploitation of this vulnerability could lead to unauthorized access and actions performed on behalf of the original user, including access to their data.

Remediation

Users can upgrade to Open OnDemand versions 3.1.15 or 4.0.7, which have fixed this vulnerability by ensuring proper password rotation for all TurboVNC versions. Alternatively, TurboVNC can be downgraded to a version lower than 3.1.2.