Skip to content

[MEDIUM] M3: Sensitive credentials logged in error paths — SMTP passwords and API keys in NC log #343

Description

@rubenvdlinde

Severity: MEDIUM

Location: lib/Controller/SettingsController.php lines 285, 364, 448, 712, 1394, 1474, 1915, 2002, 2336

Description:
Multiple error-path log statements include the full request parameter set:

'requestData' => $this->request->getParams()
'rawInput'    => $rawInput

Any 5xx exception during a config-update request (e.g. SMTP settings, API key updates) causes the complete request body — including smtpPassword, sendgridApiKey, mailgunApiKey, postmarkApiKey, sesSecretKey, mailjetSecretKey — to be written to the NC application log. Anyone with access to the log (sysadmin, log aggregation service) can harvest these credentials.

Suggested fix:
Before logging, redact known secret keys from the parameter array. At minimum, log parameter keys only (not values), or explicitly exclude credential fields.


Source: deep team-reviewer pass 2026-05-27

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions