Apache Geode project log file redaction of sensitive information vulnerability

Vulnerability

An information disclosure vulnerability in Apache Geode versions up to 1.12.4 and 1.13.4 allows sensitive values such as passwords and security properties to appear in cleartext in log files. The flaw occurs when the values begin with characters other than letters or numbers and when the property key uses the prefixes sysprop-, javax.net.ssl, or security- [1].

Exploitation

An attacker with access to Apache Geode log files can retrieve sensitive information that should have been redacted. No special network position or authentication is required beyond access to the logs themselves; the conditions are met automatically when the affected properties are configured with the specified prefixes and non-standard starting characters [1].

Impact

Successful exploitation leads to the exposure of sensitive configuration data, including passwords and SSL-related secrets, to anyone who can read the Geode log files. This compromises the confidentiality of the system and can enable further attacks [1].

Mitigation

The vulnerability is fixed in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0 [1]. Upgrading to one of these versions resolves the issue. No workarounds are documented in the available references.