Sensitive Information Logged in Apache Juneau REST Server

Executive Summary

This is an Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error without redacting them. This exposes sensitive headers like Authorization, Cookie, Proxy-Authorization, and X-API-Key in cleartext in the application logs.

Useful 0 Not Useful 0

Detection Guidance

Check application logs for exposed sensitive headers like Authorization, Cookie, Proxy-Authorization, or X-API-Key in error entries. Search for patterns indicating server errors with unredacted headers.

Useful 0 Not Useful 0

Impact Analysis

Any attacker who can trigger a server error can cause sensitive headers to be logged in plaintext. Anyone with access to the logs can then view these credentials or tokens, leading to potential unauthorized access to systems or data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR (data protection) and HIPAA (privacy) as it exposes sensitive personal or health information in logs. Organizations may face penalties for failing to protect such data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Apache Juneau to version 9.2.1 or later to fix the issue. Review and redact sensitive headers in logs if upgrading is not immediately possible.

Useful 0 Not Useful 0