Vulnerability · Published Mar 6, 2023 · Assigned by GitHub_M
CVE-2023-22481Sensitive information exposure in the logs of greader API in FreshRSS
Medium 4.0
In plain English
A medium-severity sensitive data in logs in FreshRSS from FreshRSS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).
Official description
FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in `users/_/log_api.txt` in the case where the authentication fails. The issues occurs in `authorizationToUser()` in `greader.php`. If there is an issue with the request or the credentials, `unauthorized()` or `badRequest()` is called. Both these functions are printing the return of `debugInfo()` in the logs. `debugInfo()` will return the content of the request. By default, this will be saved in `users/_/log_api.txt` and if the const `COPY_LOG_TO_SYSLOG` is true, in syslogs as well. Exploiting this issue requires having access to logs produced by FreshRSS. Using the information from the logs, a malicious individual could get users' API keys (would be displayed if the users fills in a bad username) or passwords.
Affected products (as reported)
Weakness: CWE-532 · Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N