PT-2023-18533 · Freshrss · Freshrss

Ixonae · Publicado 2023-03-06 · Atualizado 2023-03-13 · CVE-2023-22481

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Média

Vetor base

AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FreshRSS (affected versions not specified)

Description FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in users/ /log api.txt in the case where the authentication fails. The issue occurs in authorizationToUser() in greader.php. If there is an issue with the request or the credentials, unauthorized() or badRequest() is called. Both these functions are printing the return of debugInfo() in the logs. debugInfo() will return the content of the request. By default, this will be saved in users/ /log api.txt and if the const COPY LOG TO SYSLOG is true, in syslogs as well. Exploiting this issue requires having access to logs produced by FreshRSS. Using the information from the logs, a malicious individual could get users' API keys (would be displayed if the users fill in a bad username) or passwords.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2023-22481

GHSA-8VVV-JXG6-8578

Produtos afetados

Freshrss

Referências · 7

• 🔥 https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-8vvv-jxg6-8578 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22481.json · Exploit
• https://github.com/FreshRSS/FreshRSS/commit/075cf4c800063e3cc65c3d41a9c23222e8ebb554 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-22481 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-22481 · Aviso do Fabricante
• https://t.me/cibsecurity/59496 · Publicação no Telegram
• https://t.me/cvenotify/45629 · Publicação no Telegram