Webhook URL leaked via println! in production code #568

The webhook notification code in dstack/vmm/src/app/qemu.rs logs the full webhook URL including any embedded authentication tokens at the info log level, exposing secrets to anyone with log access.

Root Cause

The webhook-based auth API implementation uses println! to log the webhook URL in production code paths. Webhook URLs often contain authentication tokens or secrets in query parameters or path segments (e.g., Slack webhook URLs, GitHub webhook secrets).

// upgrade_authority.rs:100
println!("Webhook URL: {}", webhook_url);

Attack Path

1. KMS is configured with a webhook auth API that uses a URL containing authentication tokens
2. The webhook URL is printed to stdout via println!
3. stdout may be captured by logging infrastructure, container orchestrators, or monitoring systems
4. An attacker with access to logs obtains the webhook URL including its embedded secrets
5. Attacker can call the webhook directly, potentially bypassing authorization checks

Impact

Information disclosure of potentially sensitive webhook URLs through stdout. The severity depends on whether the webhook URL contains authentication tokens. If it does, the attacker gains the ability to make authenticated webhook calls.

Suggested Fix

Replace println! with a structured logging call that redacts the URL:

tracing::debug!("Webhook auth API configured");
// Do NOT log the URL itself

If the URL must be logged for debugging, redact sensitive parts:

tracing::debug!("Webhook configured for host: {}", url.host_str().unwrap_or("unknown"));

Note: This issue was created automatically. The vulnerability report was generated by Claude and has not been verified by a human.