Anchor CMS 0.12.3 - Error Log Exposure

criticalseverity

9.8CVSS score

71.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Anchor CMS 0.12.3 is susceptible to an error log exposure vulnerability due to an issue in config/error.php. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.

Impact

An attacker can gain access to sensitive information, such as usernames, passwords, and system configuration details.

Fix

Upgrade to the latest version of Anchor CMS or apply the necessary patches to fix the error log exposure vulnerability.

How to confirm it

Send: GET {{BaseURL}}/anchor/errors.log
Positive when: contains "\"date\":" and "\"message\":" and "\"trace\":["

Run it with nuclei: nuclei -id CVE-2018-7251 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-7251

info:
  name: Anchor CMS 0.12.3 - Error Log Exposure
  author: pdteam
  severity: critical
  description: |
    Anchor CMS 0.12.3 is susceptible to an error log exposure vulnerability due to an issue  in config/error.php. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
  impact: |
    An attacker can gain access to sensitive information, such as usernames, passwords, and system configuration details.
  remediation: |
    Upgrade to the latest version of Anchor CMS or apply the necessary patches to fix the error log exposure vulnerability.
  reference:
    - https://github.com/anchorcms/anchor-cms/issues/1247
    - https://twitter.com/finnwea/status/965279233030393856
    - http://packetstormsecurity.com/files/154723/Anchor-CMS-0.12.3a-Information-Disclosure.html
    - https://github.com/anchorcms/anchor-cms/releases/tag/0.12.7
    - https://nvd.nist.gov/vuln/detail/CVE-2018-7251
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-7251
    cwe-id: CWE-200
    epss-score: 0.7183
    epss-percentile: 0.9943
    cpe: cpe:2.3:a:anchorcms:anchor:0.12.3:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: anchorcms
    product: anchor
  tags: cve,cve2018,anchorcms,logs,error,packetstorm,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/anchor/errors.log'

    matchers:
      - type: word
        words:
          - '"date":'
          - '"message":'
          - '"trace":['
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from