Exposing debug.log file leads to server full path disclosure

How it was found

Summary:

The exposed debug.log file on the nextcloud.com website contains sensitive information, including the server’s full directory path. This type of information disclosure can assist attackers in understanding the internal structure of the server, potentially aiding them in planning further attacks, such as path traversal or file inclusion vulnerabilities.

Steps To Reproduce:

1. Navigate to the following URL: https://nextcloud.com/wp-content/debug.log
2. The debug.log file is publicly accessible without any authentication or authorization.
3. Review the contents of the file to observe the full directory paths, which may include sensitive server details.

Suggested Fix:

Restrict access to sensitive files such as debug.log through proper permissions or access control mechanisms. Ensure that debug information is not exposed in production environments by disabling debug logs and utilizing error handling best practices.

• POC attached

█████

Impact

The exposed server paths provide an attacker with critical internal information, enabling more targeted attacks, such as exploiting file system-based vulnerabilities. An attacker could also use this information in reconnaissance to further exploit misconfigurations or other weaknesses within the server.