Summary
Access token from query string is not redacted and is potentially exposed in system logs which may be persisted.
Details
The access token in req.query is not redacted when the LOG_STYLE is set to raw. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation.
PoC
- Set
LOG_LEVEL="raw" in the environment.
- Send a request with the
access_token in the query string.
- Notice that the
access_token in req.query is not redacted.
Impact
It impacts systems where the LOG_STYLE is set to raw. The access_token in the query could potentially be a long-lived static token. Users with impacted systems should rotate their static tokens if they were provided using query string.
References
licitdev Finder
Summary
Access token from query string is not redacted and is potentially exposed in system logs which may be persisted.
Details
The access token in
req.queryis not redacted when theLOG_STYLEis set toraw. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation.PoC
LOG_LEVEL="raw"in the environment.access_tokenin the query string.access_tokeninreq.queryis not redacted.Impact
It impacts systems where the
LOG_STYLEis set toraw. Theaccess_tokenin the query could potentially be a long-lived static token. Users with impacted systems should rotate their static tokens if they were provided using query string.References