CVE-2015-5959: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 9.8
Published: 2017-09-06T21:29Z
Repository: https://github.com/Froxlor/Froxlor
Language: PHP
Files changed: lib/classes/database/class.Database.php
Commit date: 2015-07-29 13:11:38 +0200
Commit message: replace passwords even before logging, not just for display

Signed-off-by: Michael Kaufmann (d00p) <d00p@froxlor.org>

Diff: diff --git a/lib/classes/database/class.Database.php b/lib/classes/database/class.Database.php
index 7c39ecfb..85ed594b 100644
--- a/lib/classes/database/class.Database.php
+++ b/lib/classes/database/class.Database.php
@@ -310,68 +310,68 @@ class Database {
 	 * @param bool $showerror if set to false, the error will be logged but we go on
 	 */
 	private static function _showerror($error, $showerror = true) {
 		global $userinfo, $theme, $linker;
 
+		// include userdata.inc.php
+		require FROXLOR_INSTALL_DIR."/lib/userdata.inc.php";
+
+		// le format
+		if (isset($sql['root_user'])
+		    && isset($sql['root_password'])
+		    && (!isset($sql_root) || !is_array($sql_root))
+		) {
+		    $sql_root = array(0 => array('caption' => 'Default', 'host' => $sql['host'], 'socket' => (isset($sql['socket']) ? $sql['socket'] : null), 'user' => $sql['root_user'], 'password' => $sql['root_password']));
+		}
+
+		// hide username/password in messages
+		$error_message = $error->getMessage();
+		$error_trace = $error->getTraceAsString();
+		// error-message
+		$error_message = str_replace($sql['password'], 'DB_UNPRIV_PWD', $error_message);
+		$error_message = str_replace($sql_root[0]['password'], 'DB_ROOT_PWD', $error_message);
+		// error-trace
+		$error_trace = str_replace($sql['password'], 'DB_UNPRIV_PWD', $error_trace);
+		$error_trace = str_replace($sql_root[0]['password'], 'DB_ROOT_PWD', $error_trace);
+
+		if ($error->getCode() == 2003) {
+		    $error_message = "Unable to connect to database. Either the mysql-server is not running or your user/password is wrong.";
+		    $error_trace = "";
+		}
+
 		/**
 		 * log to a file, so we can actually ask people for the error
 		 * (no one seems to find the stuff in the syslog)
 		 */
 		$sl_dir = makeCorrectDir(FROXLOR_INSTALL_DIR."/logs/");
 		if (!file_exists($sl_dir)) {
 			@mkdir($sl_dir, 0755);
 		}
 		$sl_file = makeCorrectFile($sl_dir."/sql-error.log");
 		$sqllog = @fopen($sl_file, 'a');
-		@fwrite($sqllog, date('d.m.Y H:i', time())." --- ".str_replace("\n", " ", $error->getMessage())."\n");
-		@fwrite($sqllog, date('d.m.Y H:i', time())." --- DEBUG: \n".$error->getTraceAsString()."\n");
+		@fwrite($sqllog, date('d.m.Y H:i', time())." --- ".str_replace("\n", " ", $error_message)."\n");
+		@fwrite($sqllog, date('d.m.Y H:i', time())." --- DEBUG: \n".$error_trace."\n");
 		@fclose($sqllog);
 
 		/**
 		 * log error for reporting
 		*/
 		$errid = substr(md5(microtime()), 5, 5);
 		$err_file = makeCorrectFile($sl_dir."/".$errid."_sql-error.log");
 		$errlog = @fopen($err_file, 'w');
 		@fwrite($errlog, "|CODE ".$error->getCode()."\n");
-		@fwrite($errlog, "|MSG ".$error->getMessage()."\n");
+		@fwrite($errlog, "|MSG ".$error_message."\n");
 		@fwrite($errlog, "|FILE ".$error->getFile()."\n");
 		@fwrite($errlog, "|LINE ".$error->getLine()."\n");
-		@fwrite($errlog, "|TRACE\n".$error->getTraceAsString()."\n");
+		@fwrite($errlog, "|TRACE\n".$error_trace."\n");
 		@fclose($errlog);
 
 		if ($showerror) {
 
-			// include userdata.inc.php
-			require FROXLOR_INSTALL_DIR."/lib/userdata.inc.php";
-
 			// fallback
 			$theme = 'Sparkle';
 
-			// le format
-			if (isset($sql['root_user'])
-				&& isset($sql['root_password'])
-				&& (!isset($sql_root) || !is_array($sql_root))
-			) {
-				$sql_root = array(0 => array('caption' => 'Default', 'host' => $sql['host'], 'socket' => (isset($sql['socket']) ? $sql['socket'] : null), 'user' => $sql['root_user'], 'password' => $sql['root_password']));
-			}
-
-			// hide username/password in messages
-			$error_message = $error->getMessage();
-			$error_trace = $error->getTraceAsString();
-			// error-message
-			$error_message = str_replace($sql['password'], 'DB_UNPRIV_PWD', $error_message);
-			$error_message = str_replace($sql_root[0]['password'], 'DB_ROOT_PWD', $error_message);
-			// error-trace
-			$error_trace = str_replace($sql['password'], 'DB_UNPRIV_PWD', $error_trace);
-			$error_trace = str_replace($sql_root[0]['password'], 'DB_ROOT_PWD', $error_trace);
-
-			if ($error->getCode() == 2003) {
-			    $error_message = "Unable to connect to database. Either the mysql-server is not running or your user/password is wrong.";
-			    $error_trace = "";
-			}
-
 			// clean up sensitive data
 			unset($sql);
 			unset($sql_root);
 
 			if ((isset($theme) && $theme != '')

Vulnerable code: 		@fwrite($sqllog, date('d.m.Y H:i', time())." --- ".str_replace("\n", " ", $error->getMessage())."\n");
		@fwrite($sqllog, date('d.m.Y H:i', time())." --- DEBUG: \n".$error->getTraceAsString()."\n");
		@fwrite($errlog, "|MSG ".$error->getMessage()."\n");
		@fwrite($errlog, "|TRACE\n".$error->getTraceAsString()."\n");
			// include userdata.inc.php
			require FROXLOR_INSTALL_DIR."/lib/userdata.inc.php";

			// le format
			if (isset($sql['root_user'])
				&& isset($sql['root_password'])
				&& (!isset($sql_root) || !is_array($sql_root))
			) {
				$sql_root = array(0 => array('caption' => 'Default', 'host' => $sql['host'], 'socket' => (isset($sql['socket']) ? $sql['socket'] : null), 'user' => $sql['root_user'], 'password' => $sql['root_password']));
			}

			// hide username/password in messages
			$error_message = $error->getMessage();
			$error_trace = $error->getTraceAsString();
			// error-message
			$error_message = str_replace($sql['password'], 'DB_UNPRIV_PWD', $error_message);
			$error_message = str_replace($sql_root[0]['password'], 'DB_ROOT_PWD', $error_message);
			// error-trace
			$error_trace = str_replace($sql['password'], 'DB_UNPRIV_PWD', $error_trace);
			$error_trace = str_replace($sql_root[0]['password'], 'DB_ROOT_PWD', $error_trace);

			if ($error->getCode() == 2003) {
			    $error_message = "Unable to connect to database. Either the mysql-server is not running or your user/password is wrong.";
			    $error_trace = "";
			}

Fixed code: 		// include userdata.inc.php
		require FROXLOR_INSTALL_DIR."/lib/userdata.inc.php";

		// le format
		if (isset($sql['root_user'])
		    && isset($sql['root_password'])
		    && (!isset($sql_root) || !is_array($sql_root))
		) {
		    $sql_root = array(0 => array('caption' => 'Default', 'host' => $sql['host'], 'socket' => (isset($sql['socket']) ? $sql['socket'] : null), 'user' => $sql['root_user'], 'password' => $sql['root_password']));
		}

		// hide username/password in messages
		$error_message = $error->getMessage();
		$error_trace = $error->getTraceAsString();
		// error-message
		$error_message = str_replace($sql['password'], 'DB_UNPRIV_PWD', $error_message);
		$error_message = str_replace($sql_root[0]['password'], 'DB_ROOT_PWD', $error_message);
		// error-trace
		$error_trace = str_replace($sql['password'], 'DB_UNPRIV_PWD', $error_trace);
		$error_trace = str_replace($sql_root[0]['password'], 'DB_ROOT_PWD', $error_trace);

		if ($error->getCode() == 2003) {
		    $error_message = "Unable to connect to database. Either the mysql-server is not running or your user/password is wrong.";
		    $error_trace = "";
		}

		@fwrite($sqllog, date('d.m.Y H:i', time())." --- ".str_replace("\n", " ", $error_message)."\n");
		@fwrite($sqllog, date('d.m.Y H:i', time())." --- DEBUG: \n".$error_trace."\n");
		@fwrite($errlog, "|MSG ".$error_message."\n");
		@fwrite($errlog, "|TRACE\n".$error_trace."\n");