MoguBlog Information Disclosure via getSystemConfig Endpoint

Executive Summary

MoguBlog through version 6.2 has an information disclosure vulnerability where low-privileged front-end users can read system credentials by accessing the getSystemConfig endpoint. Attackers with a valid reader session token can retrieve unfiltered SystemConfig data, exposing sensitive information like Qiniu and MinIO secret keys and SMTP mailbox passwords.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the /oauth/getSystemConfig endpoint is accessible with a low-privileged user token. Use curl to send a GET request with a valid session token to this endpoint and inspect the response for sensitive credentials like Qiniu, MinIO keys, or SMTP passwords.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to obtain system credentials, potentially leading to unauthorized access to cloud storage, email accounts, and other critical infrastructure. Attackers could misuse these credentials to exfiltrate data, manipulate stored files, or send phishing emails from legitimate accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements under GDPR and HIPAA due to unauthorized access to sensitive data and credentials. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. Exposure of such data could result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /oauth/getSystemConfig endpoint to admin-only users. Update MoguBlog to the latest patched version. Review and rotate all exposed credentials including Qiniu, MinIO, and SMTP passwords. Monitor logs for unauthorized access attempts to this endpoint.

Useful 0 Not Useful 0