Frappe 14.x Information Disclosure via Error Logs

Executive Summary

Frappe 14.x before 14.45.0 has an information disclosure vulnerability where users with error log access can view secrets stored in local variables captured in tracebacks. Attackers who can read error logs may extract plaintext secrets like credentials or keys exposed in traceback local variables.

Useful 0 Not Useful 0

Detection Guidance

Check error logs for tracebacks containing local variables that may expose secrets. Search for patterns like 'password', 'key', or 'secret' in error logs. Use commands like 'grep -r "password" /var/log/' or 'grep -r "secret" /path/to/error/logs/' to scan for exposed credentials.

Useful 0 Not Useful 0

Impact Analysis

If you use Frappe 14.x before 14.45.0, attackers with access to error logs could steal sensitive data such as passwords, API keys, or other credentials stored in local variables. This could lead to unauthorized access to systems or data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA due to unauthorized exposure of personal or sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties or fines.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Frappe to version 14.45.0 or later to patch the vulnerability. Review and sanitize error logs to remove any sensitive data before storing them. Restrict access to error logs to only authorized personnel.

Useful 0 Not Useful 0