Application Logs Contain Sensitive Information

These updates are applicable for releases - 2021.04, 2021.07, 2021.10, 2022.07, 2022.10, 2023.01, 2023.07, 2023.10.

Description

This document provides a solution to prevent any unauthenticated user from accessing the application logs containing sensitive information.

It is observed that the application logs contain sensitive information like X-Kony-Authorisation header which contains the logged in user’s JWT session token. An attacker can use this information to obtain details related to the logged in customer.

Root Logger configuration is set as Error.

Recommendation

• Do not log sensitive information in any format – plain text or encrypted.
• Replace the sensitive information with “*****” before logging in any mode i.e. Trace, Debug, Info, Warn, Error and Fatal.
• Remove the duplication of the logs in multiple files. E.g. Log contents of the middleware.log are duplicated in the server-datasource-payload.log and server-device-payload.log. As such, any sensitive information in middleware.log is duplicated in the other logs.

Solution

In all the snippets, red indicates removed or modified content, while green indicates added or replaced content.

Path:

Fabric/java/com.temenos.infinity.integration.common/src/main/java/com/kony/dbx/util/CommonUtils.java

Package: package com.kony.dbx.util;

Class: CommonUtils

Method: createServiceRequest

As shown in the above image remove the following line under createServiceRequest method.

alert.prepareError(request.getHeader("X-Kony-Authorization")).log();

Path:

Fabric/java/com.temenos.infinity.t24irisintegration/src/main/java/com/infinity/dbx/temenos/accounts/GetLatestBalancesT24PreProcessor.java

Package: com.infinity.dbx.temenos.accounts;

Class: GetLatestBalancesT24PreProcessor

Method: execute

As shown in above image remove the following code in the method execute,

alert.prepareError("input Params for GetLatestbalances T24: "+params).log();        
alert.prepareError("headers for GetLatestbalances T24: "+request.getHeaderMap()).log(); 

As shown in above snip add the following code in the method execute, in line number 23

alert.prepareError("input Params for GetLatestbalances T24: "+params).log();

As shown in above snip remove the following code in the method execute, in line number 32 and 33,

alert.prepareError("input Params for GetLatestbalances T24: "+params).log();        
alert.prepareError("headers for GetLatestbalances T24: "+request.getHeaderMap()).log(); 

As shown in above snip add the following code in the method execute, in line number 31

alert.prepareError("input Params for GetLatestbalances T24: "+params).log();

Path:

Fabric/java/DBPAdminIntegration/src/main/java/com/kony/dbputilities/utils/HelperMethods.java

Package: com.kony.dbputilities.utils;

Class: HelperMethods

Method: updateHeadersForC360Integration

As shown in above snip remove the following code in the method updateHeadersForC360Integration,

alert.prepareError("updateHeadersForC360Integration headerMap "+ headerMap).log();

Path:

Fabric/java/DBPCommonUtilityServices/src/main/java/com/kony/dbputilities/util/HelperMethods.java

Package: com.kony.dbputilities.util;

Class: HelperMethods

Method: invokeService

As shown in the above snip add the following line,

headerParams.put("X-Kony-Authorization", authToken);

Path:

Fabric/java/DBPCommonUtilityServices/src/main/java/com/temenos/dbx/product/utils/HTTPOperations.java

Package: com.temenos.dbx.product.utils;

Class: HTTPOperations

Method: sendHttpRequest

As shown in above snip, remove the following line in the method, sendHttpRequest,

diagnostic.prepareDebug("X-Kony-Authorization in request is : "+entry.getValue()).log();

Path:

 Fabric/java/DBPObjectServices/src/main/java/com/kony/task/datavalidation/OnboardingAccountValidationTask.java

Package: com.kony.task.datavalidation;

Class: OnboardingAccountValidationTask

Method: process

As shown in the snip remove the following code in the method process, in the line number 44 and 49,

diagnostic.prepareInfo("Inputted Auth Token = "+ authToken).log();
diagnostic.prepareInfo("Request headers for the getAccountsForAdmin = "+ requestHeaders).log();

Path:

Fabric/java/forexservices/util/CommonUtils.java

Package: forexservices.util;

Class: CommonUtils

Method: createServiceRequest

As shown in above snip, remove the following line in the method createServiceRequest,

alert.prepareError(request.getHeader("X-Kony-Authorization")).log();