Ech0 Unauthorized Dashboard Log Access Vulnerability

Executive Summary

Ech0 before version 4.4.3 has a missing authorization vulnerability in its dashboard log endpoints. This allows any authenticated user, even without admin privileges, to access system logs by querying endpoints like GET /api/system/logs or subscribing to SSE and WebSocket log streams. This exposes sensitive operational data such as file paths, stack traces, and internal URLs.

Useful 0 Not Useful 0

Detection Guidance

Check if unauthenticated or low-privilege users can access GET /api/system/logs, GET /api/system/logs/stream, or WebSocket endpoints like /ws/system/logs. Use curl commands such as curl -H 'Authorization: Bearer <token>' http://<target>/api/system/logs to test access. Monitor network traffic for unauthorized log stream connections.

Useful 0 Not Useful 0

Impact Analysis

Attackers with valid user sessions can retrieve sensitive operational data, including internal file paths, stack traces, and URLs. This could lead to further exploitation, data leaks, or unauthorized access to system information, posing a risk to confidentiality and operational security.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. It may result in data breaches, unauthorized disclosure of personal or health information, and failure to meet regulatory standards for access controls and audit logging.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ech0 to version 4.4.3 or later. Implement strict admin-only scope checks on log endpoints. Restrict access to /api/system/logs and related endpoints to administrators only. Review and revoke any exposed sensitive logs.

Useful 0 Not Useful 0