Executive brief
ibm_db is a Node.js library that connects applications to IBM databases. When debug logging is enabled, the library exposes database connection passwords in plaintext logs. This could allow an attacker with access to log files to steal database credentials and gain unauthorized access to the database.
Technical details
The vulnerability is a sensitive data exposure flaw in the debug logging functionality of ibm_db prior to version 2.6.0. When debug mode is enabled, the package logs the full database connection string, which includes credentials in plaintext. This is a local information disclosure vulnerability requiring debug mode to be explicitly enabled and an attacker to have read access to log files. The attack vector is local with low privileges required. An attacker who gains access to log files (through directory traversal, log aggregation systems, or file system access) can extract database credentials. The fix was implemented in version 2.6.0 to sanitize sensitive information before logging.
Affected products
- IBM ibm_db prior to 2.6.0
Timeline
- 2019-08-12: disclosed: Issue reported on GitHub
- 2020-09-03: patched: Fix released in version 2.6.0
- 2020-09-03: advisory: GHSA-p77h-hv6g-fmfp published