Anchor CMS Sites May Be Spewing Their Database Passwords

[LASER_oneXM]

Websites built using the Anchor CMS may be accidentally exposing their database passwords in publicly-facing error logs, Dutch security researcher Tijme Gommers has discovered.

Gommers says that an attacker can navigate to the following URL and download a copy of the site's errors log, where in some cases, he may find the site's database password exposed in cleartext.

site-name.com/anchor/errors.log

....
.....
.....
..........

According to a PublicWWW search query, there are almost 500 Anchor CMS sites easily discoverable online based on their meta name attribute.

Bleeping Computer has found cleartext database passwords for a few of the sites included in the PublicWWW search results.

"The errors.log file is meant to be private, however, with the default install of AnchorCMS it is public," Gommers told Bleeping Computer in a private conversation.

Users may not be aware of the importance of this file, as the Anchor CMS docs do not include any special advisory for webmasters to hide this file from the public.

How users can protect themselves
Gommers said he doesn't plan to report this bug to the Anchor CMS team. "I think its more of a DevOps issue," Gommers told us.

The security researcher believes site owners shouldn't be allowing access to the errors.log file in the first place.

"When you would want to keep using AnchorCMS I recommend disabling access to *.log files via the htaccess file for example," Gommers said. Furthermore, webmasters should be following this advice —limiting access to *.log files via htaccess— for all CMSes, not just Anchor.

An Anchor CMS developer was not available for comment on this article and security issue before publication, but the Anchor CMS team should also take note of this bug.

"To be a bit more safe I recommend changing the [Anchor CMS] code a bit to prevent getting the credentials in the log," Gommers says.

Further, adding a warning to the Anchor CMS docs about blocking access to the errors.log file would also help webmasters that are not aware of web security best practices.

But if the Anchor CMS team would like to go all-in, they can include a .htaccess file with the default installation package that blocks access to log files by default.