user_ldap app logs user passwords in the log file on level debug
Medium
Vulnerability Details
## Summary:
Nextcloud using ldap user authentication and loglevel debug write user passwords to log file.
Vulnerable versions: 26.0.4, 27.0.1.
## Steps To Reproduce:
1. Use a nextcloud with ldap user authentication.
2. Set nextcloud config loglevel to 0 (debug).
3. Login to nextcloud using a ldap user.
4. Search for lines with 'ldap_bind' in nextcloud log file.
## Supporting Material/References:
Sample log file:
```
{"reqId":"QRqbkhMpRAY1ugvQMrPk","level":0,"time":"2023-08-08T11:17:11-03:00","remoteAddr":"<IPADDRESS>","user":"--","app":"user_ldap","method":"POST","url":"/login","message":"Calling LDAP function ldap_bind with parameters [{},\"uid=<USERNAME>\",\"<PASSWORD>\"]","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36","version":"27.0.1.2","data":{"app":"user_ldap"}}
```
Affected file:
`apps/user_ldap/lib/LDAP.php`
Vulnerable code:
```
private function preFunctionCall(string $functionName, array $args): void {
$this->curArgs = $args;
$this->logger->debug('Calling LDAP function {func} with parameters {args}', [
'app' => 'user_ldap',
'func' => $functionName,
'args' => json_encode($args),
]);
```
## Impact
Local administrator can retriave user passwords.
Actions
View on HackerOneReport Stats
- Report ID: 2101165
- State: Closed
- Substate: resolved
- Upvotes: 27