FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in users/_/log_api.txt in the case where the authentication fails. The issues occurs in authorizationToUser() in greader.php. If there is an issue with the request or the credentials, unauthorized() or badRequest() is called. Both these functions are printing the return of debugInfo() in the logs. debugInfo() will return the content of the request. By default, this will be saved in users/_/log_api.txt and if the const COPY_LOG_TO_SYSLOG is true, in syslogs as well. Exploiting this issue requires having access to logs produced by FreshRSS. Using the information from the logs, a malicious individual could get users API keys (would be displayed if the users fills in a bad username) or passwords.
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Freshrss | Freshrss | 1.9.0 (including) | 1.21.0 (excluding) |
While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers. Different log files may be produced and stored for: