Poste.io logs leak

[Daniel Kalinowski]

Hello i would like to report a security misconfiguration in poste.io default installation that leads to user email and ip disclosure. In environment with extended logging enable it might leak other error log files.

Problem description:

By default roundcube store the logs in /logs/ folder, this folder is protected via .htaccess file. On nginx (default web server for poste.io) the .htaccess file is ignored, therefore the logs files inside /logs directory are accessible to anyone.

PoC:

1. Login on https://demo.poste.io/webmail/ with valid user account ie. [e-mail]:foo
2. Send and email
3. Access https://demo.poste.io/webmail/logs/sendmail
4. Decode base64 payload

WzI0LUp1bi0yMDE5IDEwOjU4OjE3ICswMjAwXTogPGVqZmF0aWxqPiBVc2VyIGZvb0Bwb3N0ZS5pbyBbMTcyLjE4LjAuMTFdOyBNZXNzYWdlIGZvciBmb29AcG9zdGUuaW87IDI1MDogTWVzc2FnZSBRdWV1ZWQgKDA3NTM2QThGLUU1OTItNEY5OS04ODFBLTlEMEYzODI2MDcxOC4xKQo=
>
[24-Jun-2019 10:58:17 +0200]: <ejfatilj> User [e-mail] [172.18.0.11]; Message for [e-mail]; 250: Message Queued (07536A8F-E592-4F99-881A-9D0F38260718.1)

‌

Fix:
Implement the nginx rules to deny the access to logs folder/ Move the logs outside the webroot directory.

[SH]

fix #665 roundcube leaks logs

→ <<cset 551ee92fa494>>

[SH]

fix #665 roundcube leaks logs

→ <<cset 551ee92fa494>>

[SH]

fix #665 roundcube leaks logs

→ <<cset 551ee92fa494>>