Zipline Information Disclosure via Unredacted OAuth Secrets

Executive Summary

Zipline versions 4.2.0 to 4.6.1 log sensitive OAuth2 client secrets, such as OAUTH_OIDC_CLIENT_SECRET, in plaintext during startup. Attackers with access to system or Docker logs can extract these secrets and misuse them to intercept OAuth2 callbacks for valid tokens.

Useful 0 Not Useful 0

Detection Guidance

Check logs for plaintext exposure of environment variables like OAUTH_OIDC_CLIENT_SECRET during application startup. Search for these variables in system journal or Docker logs using commands like 'journalctl -u zipline' or 'docker logs <container_name>'. Look for lines containing 'OAUTH_OIDC_CLIENT_SECRET' without redaction.

Useful 0 Not Useful 0

Impact Analysis

If you use Zipline versions 4.2.0 to 4.6.1, attackers could obtain OAuth2 client secrets from logs. This could lead to unauthorized access to systems protected by OAuth2, potential data breaches, or misuse of intercepted authentication tokens.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive credentials. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. Log exposure may violate these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Zipline to version 4.6.2 or later to patch the vulnerability. Review and redact any logs containing sensitive environment variables. Restrict access to system and Docker logs to prevent unauthorized access to exposed secrets.

Useful 0 Not Useful 0