When modifying an API account in the dedicated page, the token can be written in clear text in the web application log file (/var/log/rudder/webapp/) depending on logging configuration:
INFO net.liftweb.util.TimeHelpers - Service request (POST) /rudder/secure/apiaccounts/kk9Ld5eLtnOnaQ33RkdgUgxMjsPo7oP3 returned 200, took 61 Milliseconds
"POST /rudder/secure/apiaccounts/kk9Ld5eLtnOnaQ33RkdgUgxMjsPo7oP3 HTTP/1.1" 200 328 "https://rudder.example.com/rudder/secure/administration/apiManagement?" "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0"
Locally, these files are only available to privileged users, but it could be a risk if some of the logs are forwarded to a remote system.
Impact
When modifying an API account in the dedicated page, the token can be written in clear text in the web application log file (
/var/log/rudder/webapp/) depending on logging configuration:And in the apache httpd logs too with the default configuration (
/var/log/rudder/apache2):Locally, these files are only available to privileged users, but it could be a risk if some of the logs are forwarded to a remote system.
Patches
Workarounds
warnReferences