Ethercreative Logs 3.0.3 - Path Traversal

Ethercreative Logs 3.0.3 — Path Traversal (CVE-2022-23409)

This article examines a path traversal vulnerability in the Ethercreative "Logs" plugin for Craft CMS (versions ≤ 3.0.3), tracked as CVE-2022-23409. It explains the root cause, impact, detection approaches, and secure remediation. Practical examples and code-level remediation are included so defenders and maintainers can quickly mitigate risk and harden similar endpoints.

Quick facts

Product	Ethercreative Logs plugin for Craft CMS
Affected versions	≤ 3.0.3
Fixed version	≥ 3.0.4
CVE	CVE-2022-23409
Attack vector	Authenticated path traversal — arbitrary file read as webserver user
Discovery	SEC Consult Vulnerability Lab (found 2021-07-06)

Background

The Logs plugin provides a convenience interface in the Craft CMS control panel (CP) to read and stream server-side log files. A controller action exposed a parameter that was concatenated with the logs directory and then passed directly to file_get_contents() without adequate validation. This permitted directory traversal sequences (for example, "../") inside the value of the log parameter, allowing an authenticated admin to read arbitrary files accessible to the webserver user.

Vulnerability details (root cause)

The vulnerable code joined the storage/logs directory with an unvalidated user-supplied filename and read it directly. The absence of normalization and containment checks let attackers traverse outside the intended directory.

public function actionStream ()
{
    $logsDir = \Craft::getAlias('@storage/logs');
    $logFile = \Craft::$app->request->getParam('log');
    $currentLog = \Craft::$app->request->get('log', $logFile);
    $log = file_get_contents($logsDir . '/' . $currentLog);
    exit($log);
}

Explanation: The controller uses a request parameter "log" to select which file to stream. It simply concatenates the logs directory with that parameter and calls file_get_contents(). If an attacker supplies a value like "../../.env", the concatenated path points outside the intended directory and the file contents are returned.

Impact and risk

• An authenticated user with CP access (administrator role typically required) could read arbitrary files readable by the webserver (commonly www-data or apache), including secrets such as .env, database credentials, configuration files, or SSH keys stored in web-accessible locations.
• While the endpoint requires CMS authentication, stolen or weak admin credentials, or a pivoted admin session, makes exploitation feasible.
• Confidentiality impact is high for systems with sensitive configuration files in the webroot or otherwise readable by the web user; integrity and availability are not directly impacted by this vulnerability alone.

Safe proof-of-concept (defensive/testing use only)

Only test on systems you own or have explicit authorization to test. The vulnerable endpoint is:

GET /index.php/admin/actions/logs/logs/stream?log=../../.env

Explanation: This demonstrates the parameter used for traversal. A successful response may include configuration values. Do not use this against third-party or production systems you are not authorized to test.

Detection and indicators

Look for requests to the plugin's stream action that include directory traversal patterns or unusual file reads. Typical signs to detect exploitation or scanning attempts include:

• HTTP requests to /admin/actions/logs/logs/stream with query strings containing "../" or absolute paths.
• Unexpected retrieval of files such as .env, composer.json, config.php, or other configuration artifacts returned by the endpoint.
• Unusual CP activity from administrator sessions at odd hours or from suspicious IPs.

# Example Splunk-style search (adjust index/sourcetype to your environment)
index=web_access "/admin/actions/logs/logs/stream" OR (uri_query="*log=*")
| search uri_query="*..*"
| table _time, clientip, user, uri, uri_query

Explanation: The search looks for access to the stream endpoint and filters requests where the query parameter contains traversal sequences. Tune and test in your environment to avoid false positives.

# Simple regex you can use in WAF or IDS rules:
^/index\.php/admin/actions/logs/logs/stream(\?.*log=.*(\.\./|\.\.\\))

Explanation: This regex matches requests to the vulnerable endpoint containing "../" (forward or backward slashes) inside the "log" parameter. Use as a starting point for blocking or alerting rules in a WAF or IDS/IPS.

Remediation — recommended secure fixes

The vendor released a patch in version 3.0.4. The correct approach is to upgrade the plugin to ≥3.0.4 as soon as possible. If you cannot upgrade immediately, apply one or more of the following mitigations:

• Disable or uninstall the Logs plugin until patched.
• Restrict access to the Craft control panel to trusted IPs and enforce strong admin credentials and MFA.
• Apply a WAF rule to block requests with directory traversal patterns against the endpoint.
• Harden file permissions so that sensitive files are not readable by the webserver where feasible.

Secure code pattern (recommended)

Below is a secure approach to handle path arguments: normalize the base directory with realpath(), build the candidate path safely, then check containment (that the resolved path is inside the allowed base). Also validate the parameter against a whitelist pattern or allowed filenames if possible.

public function actionStream()
{
    // Resolve storage/logs to an absolute directory
    $logsDir = realpath(\Craft::getAlias('@storage/logs'));
    if ($logsDir === false) {
        throw new \yii\web\ServerErrorHttpException('Logs directory not available.');
    }

    // Get requested file name (no default accepted without validation)
    $requested = \Craft::$app->request->getParam('log');
    if (empty($requested)) {
        throw new \yii\web\BadRequestHttpException('Missing log parameter.');
    }

    // Basic disallow of null bytes and stream wrappers
    if (strpos($requested, "\0") !== false || preg_match('/^[a-zA-Z0-9_.\-\/]+$/', $requested) === 0) {
        throw new \yii\web\BadRequestHttpException('Invalid log parameter.');
    }

    // Build the absolute path and resolve it
    $candidate = realpath($logsDir . DIRECTORY_SEPARATOR . $requested);
    if ($candidate === false || strpos($candidate, $logsDir) !== 0) {
        throw new \yii\web\BadRequestHttpException('Requested file is outside allowed directory.');
    }

    // Optionally enforce a filename whitelist or depth limit here

    $contents = file_get_contents($candidate);
    exit($contents);
}

Explanation: This snippet does several things:

• Uses realpath() on both the base logs directory and the constructed path to collapse ../ sequences and resolve symlinks.
• Validates the requested parameter (no null bytes, restricted character set). Adjust the regex to match your expected filenames.
• Checks that the resolved absolute path (candidate) starts with the logs directory path, preventing traversal beyond the intended directory.
• Provides clear error responses instead of silently returning file contents.

Workarounds and immediate mitigations

• Upgrade the plugin to 3.0.4 or newer — the vendor patch removes the vulnerability.
• Temporarily disable the Logs plugin if you cannot immediately upgrade, and access logs via SSH or other secure channels.
• Limit CP admin access via IP allowlists, VPN, or network segmentation.
• Ensure sensitive configuration files are stored outside the webroot and have appropriate filesystem permissions.

For defenders: detection playbook

• Search web server access logs for the stream endpoint and suspicious query parameters (../, %2e%2e, etc.).
• Audit admin session logs and correlate to unusual file contents being returned by the CP (especially .env or config files).
• Deploy WAF rules to block traversal patterns targeting the specific path and alert on attempts.
• Scan your Craft sites for the plugin and ensure all instances are at 3.0.4 or later.

Vendor timeline and disclosure

SEC Consult reported the issue to the vendor in July 2021. The vendor released a patched version (3.0.4) shortly afterwards. Public advisory and CVE assignment followed in early 2022.

Conclusion and best practices

Path traversal remains a common class of vulnerability when untrusted input is used to select filesystem resources. The key lessons from CVE-2022-23409 are:

• Never concatenate unvalidated user input directly into filesystem paths.
• Always normalize (realpath) and verify that resolved paths are contained within an allowed base directory.
• Prefer whitelisting allowed filenames or enumerating available files for selection rather than accepting arbitrary names.
• Keep plugins and dependencies up to date; monitor vendor advisories and CVE feeds.

If you operate Craft CMS instances, inventory any installations using the Ethercreative Logs plugin and update immediately to version 3.0.4 or later. If you suspect your environment was exposed, rotate secrets that may have been read (database credentials, API keys) and perform an incident response review of admin sessions and access logs.