Impact Analysis

The vulnerability allows attackers who have access to application logs to intercept password reset tokens. This can lead to unauthorized account takeover, compromising user accounts and potentially exposing sensitive user data or allowing malicious actions under the guise of legitimate users.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in OneUptime versions prior to 10.0.24. During the password reset process, the application logs the entire password reset URL, which includes the plaintext reset token, at the INFO log level. Since INFO logging is enabled by default in production environments, anyone who has access to the application logs—such as log aggregation systems, Docker logs, or Kubernetes pod logs—can see these reset tokens. With these tokens, an attacker can perform account takeover on any user.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by inspecting the application logs for the presence of password reset URLs containing plaintext reset tokens. Since the reset URLs are logged at the INFO level by default, reviewing logs from log aggregation systems, Docker logs, or Kubernetes pod logs can reveal these tokens.

Commands to detect this might include searching logs for reset URLs or tokens. For example, using grep on log files or logs streams:

• grep -i 'reset' /path/to/application/logs/*
• kubectl logs <pod-name> | grep -i 'reset'
• docker logs <container-id> | grep -i 'reset'

These commands help identify if reset URLs with tokens are being logged, indicating exposure to the vulnerability.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade OneUptime to version 10.0.24 or later, where this vulnerability is fixed.

Additionally, restrict access to application logs to trusted personnel only, and consider temporarily disabling or reducing the log level of password reset flows to avoid logging sensitive tokens.

Useful 0 Not Useful 0