Description

Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T14:17:05.633Z",
  "pubdate": "2026-08-13T14:17:05.633Z",
  "executiveSummary": "An unauthenticated sensitive data exposure vulnerability exists in the REST API Log application for versions 1.7.1 and below. This security flaw allows unauthenticated remote threat actors to access and retrieve sensitive information logged by the REST API Log component without requiring prior authentication or valid session credentials.\nThe primary impact of this vulnerability involves the unauthorized disclosure of confidential operational data, internal system states, potential credentials, Personally Identifiable Information (PII), or application secrets that were inadvertently captured within API transaction logs. Such data leakage severely compromises confidentiality and provides malicious actors with critical intelligence for subsequent exploitation phases.\nThe affected product is REST API Log in all versions up to and including 1.7.1. The risk implications are substantial, as successful exploitation enables passive or active harvesting of sensitive payloads traversing the application interfaces. The attacker capabilities required are minimal, as the attack vector requires no privileges, special access rights, or authentication tokens. Exploitation requirements are limited to network connectivity to the vulnerable endpoint hosting the REST API Log functionality, exposing the system to broad internet-based reconnaissance and automated data extraction attacks.",
  "technicalDetails": "The vulnerability stems from improper access control enforcement within the REST API Log component for versions 1.7.1 and prior. Specifically, the architectural flaw resides in the handling of HTTP requests directed at logging endpoints or administrative interfaces responsible for displaying recorded API transaction history. The root cause is the absence of adequate authentication checks and authorization validations prior to serving logged data payload contents back to the requester.\nNetwork exposure for this vulnerability is typically external, as the vulnerable REST API Log endpoints are exposed over standard network protocols such as HTTP or HTTPS. Because the application fails to validate the identity of incoming connections, any remote client can issue direct requests to the logging mechanism. The exploitation method relies on sending crafted HTTP GET or similar retrieval requests to the exposed API routes designated for log inspection or retrieval.\nThe attack flow proceeds in a sequential manner. First, the unauthenticated attacker performs reconnaissance or scans the target application to identify endpoints associated with REST API Log <= 1.7.1. Upon identifying the accessible log retrieval endpoint, the attacker constructs an HTTP request targeting the data viewing or export functionality. Due to the lack of access controls, the vulnerable component bypasses any authentication gates and directly queries the underlying storage where API transaction logs are persisted. The component then compiles the historical log data—which may include sensitive headers, authorization tokens, request bodies, and response payloads containing confidential parameters—and serializes this information into an HTTP response. Finally, the server transmits the response back to the unauthenticated attacker.\nThe payload behavior during exploitation is primarily read-oriented, focusing on data exfiltration rather than code execution or system modification. However, the post-exploitation impact is severe due to the nature of the exposed data. Adversaries can analyze the harvested logs to extract API keys, session tokens, internal IP addresses, database schemas, and user PII. These artifacts frequently facilitate privilege escalation, lateral movement, or direct compromise of backend services integrated with the application, neutralizing the confidentiality guarantees of the entire API ecosystem."
}