Description

MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials via the getSystemConfig endpoint. Attackers can supply an ordinary reader session token to retrieve unfiltered SystemConfig data, exposing Qiniu and MinIO secret keys and SMTP mailbox passwords.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T13:17:30.040Z",
  "pubdate": "2026-10-12T13:17:30.040Z",
  "executiveSummary": "MoguBlog versions through 6.2 are affected by an information disclosure vulnerability stemming from improper access control in the application's configuration retrieval mechanism.\nThe vulnerability resides in the getSystemConfig endpoint, which fails to enforce sufficient privilege checks, allowing low-privileged front-end users to access sensitive system-wide configuration data.\nBy submitting a standard user session token, an authenticated attacker can exfiltrate high-value credentials, including Qiniu secret keys, MinIO secret keys, and SMTP server authentication passwords.\nThis exposure represents a critical security risk as it facilitates lateral movement, potential infrastructure compromise, and unauthorized access to integrated third-party cloud storage and communication services.\nThe vulnerability is exploitable by any authenticated front-end user, requiring no elevated administrative permissions, making it a significant risk in multi-user deployments where user registration is enabled.",
  "technicalDetails": "The vulnerability is categorized as an Improper Authorization flaw, specifically concerning the getSystemConfig function within the MoguBlog codebase. The root cause is a failure in the server-side access control logic, which does not adequately validate the authorization level of the user requesting system-level configuration parameters.\nIn the affected versions, the getSystemConfig endpoint is reachable by users authenticated with standard front-end reader session tokens. Rather than restricting access to the system administrative role, the application logic proceeds to process the request and serializes the full system configuration object to the client.\nThe attack flow begins when an attacker performs a standard login to obtain a valid session token. With this token, the attacker crafts an HTTP request targeting the getSystemConfig endpoint. Upon receiving this request, the backend service fails to perform a role-based access control (RBAC) check against the requester's identity. Consequently, the application fetches the entire SystemConfig entity from the persistence layer and returns the unfiltered data structure to the attacker in the HTTP response body.\nThe data returned typically includes sensitive keys and credentials necessary for the platform's operation. Specifically, the disclosure includes Qiniu and MinIO secret keys, which grant attackers read/write access to object storage buckets associated with the MoguBlog instance. Furthermore, the exposure of SMTP mailbox passwords allows an attacker to intercept outgoing emails, send spoofed communications, or utilize the mail server for malicious relaying.\nBecause the exposure occurs at the application layer, no specialized network-level exploitation is required beyond standard HTTPS access to the web portal. The vulnerability is persistent across all versions up to 6.2 and does not require complex payload injection, as the endpoint is natively designed to return configuration data, albeit intended for privileged administrators only.\nPost-exploitation impact is severe, as the compromised credentials provide a direct vector to compromise external dependencies. An attacker can pivot from the web application to the cloud infrastructure (Qiniu/MinIO) or leverage compromised SMTP credentials for phishing campaigns or social engineering, effectively bypassing the security perimeter of the MoguBlog deployment."
}