Executive brief
log4js is a Node.js logging library used to record application events and debugging information. By default, log files created by the file, fileSync, and dateFile appenders are world-readable, potentially exposing sensitive information such as authentication tokens, user data, or system details recorded in logs to any local user on the system.
Technical details
This vulnerability is a file permissions issue (CWE-276, CWE-708) where log files created by log4js appenders are written with overly permissive default file modes that allow any local user to read their contents. The vulnerable components are the file, fileSync, and dateFile appenders in log4js and its streamroller dependency. The attack vector is local with low complexity—an attacker with local system access can simply read world-readable log files without requiring elevated privileges. The impact is confidentiality loss: sensitive application data stored in logs becomes accessible to unauthorized local users. Fixed in log4js@6.4.0 (released January 2022); users can work around the issue by explicitly setting the mode parameter in file appender configuration.
Affected products
- log4js log4js < 6.4.0
Timeline
- 2022-01-19: disclosed
- 2022-01-21: patched: Fixed in log4js@6.4.0