An information exposure through log file vulnerability exists in Cortex XSOAR software where the secrets configured for the SAML single sign-on (SSO) integration can be logged to the /var/log/demisto/ server logs when testing the integration during setup. This logged information includes the private key and identity provider certificate used to configure the SAML SSO integration. This issue impacts: Cortex XSOAR 5.5.0 builds earlier than 98622; Cortex XSOAR 6.0.1 builds earlier than 830029; Cortex XSOAR 6.0.2 builds earlier than 98623; Cortex XSOAR 6.1.0 builds earlier than 848144.
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cortex_xsoar | Paloaltonetworks | 5.5.0 (including) | 5.5.0 (including) |
| Cortex_xsoar | Paloaltonetworks | 5.5.0-70066 (including) | 5.5.0-70066 (including) |
| Cortex_xsoar | Paloaltonetworks | 5.5.0-73387 (including) | 5.5.0-73387 (including) |
| Cortex_xsoar | Paloaltonetworks | 5.5.0-75211 (including) | 5.5.0-75211 (including) |
| Cortex_xsoar | Paloaltonetworks | 5.5.0-78518 (including) | 5.5.0-78518 (including) |
| Cortex_xsoar | Paloaltonetworks | 5.5.0-94592 (including) | 5.5.0-94592 (including) |
| Cortex_xsoar | Paloaltonetworks | 6.0.1 (including) | 6.0.1 (including) |
| Cortex_xsoar | Paloaltonetworks | 6.0.1-81077 (including) | 6.0.1-81077 (including) |
| Cortex_xsoar | Paloaltonetworks | 6.0.2 (including) | 6.0.2 (including) |
| Cortex_xsoar | Paloaltonetworks | 6.0.2-90947 (including) | 6.0.2-90947 (including) |
| Cortex_xsoar | Paloaltonetworks | 6.0.2-93351 (including) | 6.0.2-93351 (including) |
| Cortex_xsoar | Paloaltonetworks | 6.0.2-94597 (including) | 6.0.2-94597 (including) |
| Cortex_xsoar | Paloaltonetworks | 6.0.2-97682 (including) | 6.0.2-97682 (including) |
| Cortex_xsoar | Paloaltonetworks | 6.1.0 (including) | 6.1.0 (including) |
While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers. Different log files may be produced and stored for: