CVE-2018-8947: Cleartext Storage of Sensitive Information (CWE-312)
value: rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.
CWE description: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CVSS v3 base score: 7.5
Published: 2018-03-25T16:29Z
Repository: https://github.com/rap2hpoutre/laravel-log-viewer
Language: PHP
Files changed: src/controllers/LogViewerController.php, src/views/log.blade.php
Commit date: 2018-03-07 10:16:17 +0100
Commit message: security fix

Diff: diff --git a/src/controllers/LogViewerController.php b/src/controllers/LogViewerController.php
index c0aabff..acc673e 100644
--- a/src/controllers/LogViewerController.php
+++ b/src/controllers/LogViewerController.php
@@ -18,17 +18,17 @@ class LogViewerController extends BaseController
 
     public function index()
     {
 
         if ($this->request->input('l')) {
-            LaravelLogViewer::setFile(base64_decode($this->request->input('l')));
+            LaravelLogViewer::setFile(\Crypt::decrypt($this->request->input('l')));
         }
 
         if ($this->request->input('dl')) {
-            return $this->download(LaravelLogViewer::pathToLogFile(base64_decode($this->request->input('dl'))));
+            return $this->download(LaravelLogViewer::pathToLogFile(\Crypt::decrypt($this->request->input('dl'))));
         } elseif ($this->request->has('del')) {
-            app('files')->delete(LaravelLogViewer::pathToLogFile(base64_decode($this->request->input('del'))));
+            app('files')->delete(LaravelLogViewer::pathToLogFile(\Crypt::decrypt($this->request->input('del'))));
             return $this->redirect($this->request->url());
         } elseif ($this->request->has('delall')) {
             foreach(LaravelLogViewer::getFiles(true) as $file){
                 app('files')->delete(LaravelLogViewer::pathToLogFile($file));
             }
diff --git a/src/views/log.blade.php b/src/views/log.blade.php
index 4ad7f10..066bc03 100644
--- a/src/views/log.blade.php
+++ b/src/views/log.blade.php
@@ -69,11 +69,11 @@
     <div class="col sidebar mb-3">
       <h1><i class="fa fa-calendar" aria-hidden="true"></i> Laravel Log Viewer</h1>
       <p class="text-muted"><i>by Rap2h</i></p>
       <div class="list-group">
         @foreach($files as $file)
-          <a href="?l={{ base64_encode($file) }}"
+          <a href="?l={{ \Crypt::encrypt($file) }}"
              class="list-group-item @if ($current_file == $file) llv-active @endif">
             {{$file}}
           </a>
         @endforeach
       </div>
@@ -118,14 +118,14 @@
           </tbody>
         </table>
       @endif
       <div class="p-3">
         @if($current_file)
-          <a href="?dl={{ base64_encode($current_file) }}"><span class="fa fa-download"></span>
+          <a href="?dl={{ \Crypt::encrypt($current_file) }}"><span class="fa fa-download"></span>
             Download file</a>
           -
-          <a id="delete-log" href="?del={{ base64_encode($current_file) }}"><span
+          <a id="delete-log" href="?del={{ \Crypt::encrypt($current_file) }}"><span
                 class="fa fa-trash"></span> Delete file</a>
           @if(count($files) > 1)
             -
             <a id="delete-all-log" href="?delall=true"><span class="fa fa-trash"></span> Delete all files</a>
           @endif

Vulnerable code:             LaravelLogViewer::setFile(base64_decode($this->request->input('l')));
            return $this->download(LaravelLogViewer::pathToLogFile(base64_decode($this->request->input('dl'))));
            app('files')->delete(LaravelLogViewer::pathToLogFile(base64_decode($this->request->input('del'))));
          <a href="?l={{ base64_encode($file) }}"
          <a href="?dl={{ base64_encode($current_file) }}"><span class="fa fa-download"></span>
          <a id="delete-log" href="?del={{ base64_encode($current_file) }}"><span
Fixed code:             LaravelLogViewer::setFile(\Crypt::decrypt($this->request->input('l')));
            return $this->download(LaravelLogViewer::pathToLogFile(\Crypt::decrypt($this->request->input('dl'))));
            app('files')->delete(LaravelLogViewer::pathToLogFile(\Crypt::decrypt($this->request->input('del'))));
          <a href="?l={{ \Crypt::encrypt($file) }}"
          <a href="?dl={{ \Crypt::encrypt($current_file) }}"><span class="fa fa-download"></span>
          <a id="delete-log" href="?del={{ \Crypt::encrypt($current_file) }}"><span