CVE-2017-1000171
📋 TL;DR
Mahara Mobile versions before 1.2.1 log user passwords in plain text in the Mahara access log. This allows anyone with access to these logs to read user credentials. All users of vulnerable Mahara Mobile installations are affected.
💻 Affected Systems
- Mahara Mobile
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the Mahara system, potentially compromising all user accounts, stealing sensitive data, and using the platform for further attacks.
Likely Case
Unauthorized users with log access can harvest credentials to impersonate legitimate users, access their data, and potentially pivot to other systems if password reuse occurs.
If Mitigated
With proper log access controls and monitoring, impact is limited to authorized administrators who could still see passwords but would be audited.
🎯 Exploit Status
Exploitation requires access to Mahara access logs, which typically requires some level of system access. The vulnerability is simple to exploit once log access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.1
Vendor Advisory: https://github.com/MaharaProject/mahara-mobile/issues/33
Restart Required: Yes
Instructions:
1. Upgrade Mahara Mobile to version 1.2.1 or later. 2. Restart the Mahara Mobile service. 3. Verify the fix by checking that passwords are no longer logged in plain text.
🔧 Temporary Workarounds
Restrict Log Access
linuxLimit access to Mahara access logs to only authorized administrators.
chmod 640 /path/to/mahara/logs/*
chown root:admin /path/to/mahara/logs/*
Disable Detailed Logging
allConfigure Mahara to not log sensitive authentication data.
Edit Mahara configuration to reduce logging verbosity for authentication events
🧯 If You Can't Patch
- Implement strict access controls on log files and directories
- Monitor log access and implement alerting for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check Mahara Mobile version. If version is below 1.2.1, examine access logs for plain text password entries.Check Version:
Check Mahara Mobile configuration or package manager for version informationVerify Fix Applied:
After patching, verify that passwords are no longer visible in plain text in Mahara access logs.📡 Detection & Monitoring
Log Indicators:
- Plain text passwords appearing in Mahara access logs
- Unauthorized access to log files
Network Indicators:
- Unusual authentication patterns from log file locations
SIEM Query:
source="mahara_logs" AND "password="