user_ldap app logs user passwords in the log file on level debug

Disclosed: 2023-11-21 11:39:25 By alacn1 To nextcloud
Medium
Vulnerability Details
## Summary: Nextcloud using ldap user authentication and loglevel debug write user passwords to log file. Vulnerable versions: 26.0.4, 27.0.1. ## Steps To Reproduce: 1. Use a nextcloud with ldap user authentication. 2. Set nextcloud config loglevel to 0 (debug). 3. Login to nextcloud using a ldap user. 4. Search for lines with 'ldap_bind' in nextcloud log file. ## Supporting Material/References: Sample log file: ``` {"reqId":"QRqbkhMpRAY1ugvQMrPk","level":0,"time":"2023-08-08T11:17:11-03:00","remoteAddr":"<IPADDRESS>","user":"--","app":"user_ldap","method":"POST","url":"/login","message":"Calling LDAP function ldap_bind with parameters [{},\"uid=<USERNAME>\",\"<PASSWORD>\"]","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36","version":"27.0.1.2","data":{"app":"user_ldap"}} ``` Affected file: `apps/user_ldap/lib/LDAP.php` Vulnerable code: ``` private function preFunctionCall(string $functionName, array $args): void { $this->curArgs = $args; $this->logger->debug('Calling LDAP function {func} with parameters {args}', [ 'app' => 'user_ldap', 'func' => $functionName, 'args' => json_encode($args), ]); ``` ## Impact Local administrator can retriave user passwords.
Actions
View on HackerOne
Report Stats
  • Report ID: 2101165
  • State: Closed
  • Substate: resolved
  • Upvotes: 27
Share this report