Information Disclosure via Publicly Accessible Debug Log

How it was found

Summary

A publicly accessible WordPress debug.log file via █████████ was discovered on the target system. The file contains PHP warnings and deprecated notices that disclose sensitive server paths and plugin details. This exposure may assist an attacker in fingerprinting the environment, exploiting known vulnerabilities in specific plugins, or using path disclosure for further attacks such as Local File Inclusion (LFI) or Remote File Inclusion (RFI).

Impact

Impact

• Sensitive Path Disclosure: Reveals full server-side file system path /home/site/wwwroot/.
• Plugin Identification: Exposes wp-optimize plugin location and code usage, enabling attackers to check for known CVEs or vulnerabilities.
• Error Handling Insights: Shows how the system processes unexpected input, which may aid attackers in bypassing validation or exploiting improper input handling.
• Future Risk: If the log continues to grow, it may record sensitive data such as tokens, API keys, SQL queries, or user credentials.

Overall, this issue significantly increases the attack surface by leaking detailed environment information to unauthenticated users.

System Host(s)

███████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

Proof of Concept (PoC)

1. Navigate to the following URL in a browser:

   ████████
   

2. The log file is directly installed and returns sensitive server-side information. Example snippet:

   [18-Jun-2025 15:19:46 UTC] PHP Warning:  Undefined array key "host" in /home/site/wwwroot/wp-content/plugins/wp-optimize/cache/class-wpo-cache-config.php on line 251
   [18-Jun-2025 15:19:46 UTC] PHP Deprecated:  strtolower(): Passing null to parameter #1 ($string) of type string is deprecated in /home/site/wwwroot/wp-content/plugins/wp-optimize/cache/class-wpo-cache-config.php on line 251
   

Suggested Mitigation/Remediation Actions

Recommendation

1. Disable Public Access

   • Restrict direct access to *.log files using .htaccess or web server rules.
   • Example (Apache):

     <FilesMatch "\.log$">
       Require all denied
     </FilesMatch>
     

2. Disable Debugging in Production

   • Ensure that WP_DEBUG and WP_DEBUG_LOG are disabled in wp-config.php:

     define('WP_DEBUG', false);
     define('WP_DEBUG_LOG', false);
     

3. Update Plugins

   • Update wp-optimize to the latest version to patch any related vulnerabilities and deprecated function calls.

4. Log Management

   • Regularly review logs for sensitive information and clear unnecessary entries.