Summary
Improper Privilege Management in Conda ‘loguru’ can allow an unprivileged user to read log files and disclose sensitive information.
Product
Conda ‘loguru’ prior to 0.6.0.
Steps to reproduce
data="Data to be logged , password123 is incorrect" #sensitive data logging
logger.add("combined.log") #creating log file with insecure permission
logger.info(data)Expected result:
A combined.log file will be created with all log information . Check file permission:
-rw-rw-r-- 1 user user 345 Jan 11 14:47 combined.logThis file has read permission for all system users, thus any user can read this log file.
Remediation
Change the logfile permission to be accessed only by current user who crated the file or sudo user. Or update Conda ‘loguru’ to version 0.6.0.
Credit
This issue was reported by @ranjit-git through huntr.dev.
