OctoberCMS up to 3.0.x debugbar Plugin Log log file

Summaryinfo

A vulnerability, which was classified as problematic, has been found in OctoberCMS up to 3.0.x. This vulnerability affects unknown code of the component debugbar Plugin. This manipulation causes log file (Log). This vulnerability is registered as CVE-2020-11094. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in OctoberCMS up to 3.0.x. Affected by this vulnerability is an unknown functionality of the component debugbar Plugin. The manipulation with an unknown input leads to a log file vulnerability (Log). The CWE definition for the vulnerability is CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. As an impact it is known to affect confidentiality. The summary by CVE is:

The October CMS debugbar plugin before version 3.1.0 contains a feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potential exists for them to use this feature to view all requests being made to the application and obtain sensitive information from those requests. There even exists the potential for account takeovers of authenticated users by non-authenticated public users, which would then lead to a number of other potential issues as an attacker could theoretically get full access to the system if the required conditions existed. Issue has been patched in v3.1.0 by locking down access to the debugbar to all users; it now requires an authenticated backend user with a specifically enabled permission before it is even usable, and the feature that allows access to stored request information is restricted behind a different permission that's more restrictive.

The weakness was published 06/04/2020 (GitHub Repository). It is possible to read the advisory at github.com. This vulnerability is known as CVE-2020-11094 since 03/30/2020. The exploitation appears to be difficult. The attack can be launched remotely. The successful exploitation needs a single authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 3.1.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• OctoberCMS

Version

• 3.0

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion