CVE-2018-8947 (published 2018-03-25T16:29Z)

rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.

Severity: MEDIUM
CVSS v2 base score: 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
CVSS v3 base score: 7.5, HIGH (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-312
cwe_name: Cleartext Storage of Sensitive Information
description: The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
extended_description: 
	 Because the information is stored in cleartext (i.e., unencrypted), attackers could potentially read it. Even if the information is encoded in a way that is not human-readable, certain techniques could determine which encoding is being used, then decode the information.
	 When organizations adopt cloud services, it can be easier for attackers to access the data from anywhere on the Internet.
	 In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
       
         

Fix information:
repo_url: https://github.com/rap2hpoutre/laravel-log-viewer
commit_details: repo_url: https://github.com/rap2hpoutre/laravel-log-viewer
author: rap2h
author_date: 2018-03-07 10:16:17+01:00
msg: security fix
repository: repo_url: https://github.com/rap2hpoutre/laravel-log-viewer
repo_name: rap2hpoutre/laravel-log-viewer
description: :dromedary_camel: Laravel log viewer
repo_language: PHP
owner: rap2hpoutre
file_changes: filename: LogViewerController.php
change_type: ModificationType.MODIFY
diff: @@ -20,13 +20,13 @@ class LogViewerController extends BaseController
     {
 
         if ($this->request->input('l')) {
-            LaravelLogViewer::setFile(base64_decode($this->request->input('l')));
+            LaravelLogViewer::setFile(\Crypt::decrypt($this->request->input('l')));
         }
 
         if ($this->request->input('dl')) {
-            return $this->download(LaravelLogViewer::pathToLogFile(base64_decode($this->request->input('dl'))));
+            return $this->download(LaravelLogViewer::pathToLogFile(\Crypt::decrypt($this->request->input('dl'))));
         } elseif ($this->request->has('del')) {
-            app('files')->delete(LaravelLogViewer::pathToLogFile(base64_decode($this->request->input('del'))));
+            app('files')->delete(LaravelLogViewer::pathToLogFile(\Crypt::decrypt($this->request->input('del'))));
             return $this->redirect($this->request->url());
         } elseif ($this->request->has('delall')) {
             foreach(LaravelLogViewer::getFiles(true) as $file){

programming_language: PHP
filename: log.blade.php
change_type: ModificationType.MODIFY
diff: @@ -71,7 +71,7 @@
       <p class="text-muted"><i>by Rap2h</i></p>
       <div class="list-group">
         @foreach($files as $file)
-          <a href="?l={{ base64_encode($file) }}"
+          <a href="?l={{ \Crypt::encrypt($file) }}"
              class="list-group-item @if ($current_file == $file) llv-active @endif">
             {{$file}}
           </a>
@@ -120,10 +120,10 @@
       @endif
       <div class="p-3">
         @if($current_file)
-          <a href="?dl={{ base64_encode($current_file) }}"><span class="fa fa-download"></span>
+          <a href="?dl={{ \Crypt::encrypt($current_file) }}"><span class="fa fa-download"></span>
             Download file</a>
           -
-          <a id="delete-log" href="?del={{ base64_encode($current_file) }}"><span
+          <a id="delete-log" href="?del={{ \Crypt::encrypt($current_file) }}"><span
                 class="fa fa-trash"></span> Delete file</a>
           @if(count($files) > 1)
             -

programming_language: HTML