🔧 Security Enhancements
Summary
The enhancements are intended to bolster our system's overall security posture and defend against potential threats.
Affected Version
Solution
Vulnerability Details
> ZDI-CAN-XXXXX: Logsign delete_gsuite_key_file Arbitrary File Deletion Vulnerability
Logsign does not properly validate the filename parameter in the delete_gsuite_api_key_file() function.
This function is associated with the /api/settings/delete_gsuite_key_file/<filename> endpoint.
When an HTTP DELETE request is made, the function fails to check if the filename is a valid .p12 file, leading to arbitrary file deletion within specified directories, such as /opt/logsign-poller/pollers/ or /hdfs/opt/var/log/ (if cluster mode is enabled).
An authenticated attacker with the delete_settings_device_list permission can exploit this vulnerability to delete any file within these directories including sensitive or system configuration files.
Mitigating Factors
Customers are advised to ensure they always have the latest version of the program.
Acknowledgement
Logsign would like to thank the Trend Micro Zero Day Initiative team for responsibly disclosing this issue.