GHSA-cp79-9mwr-wr49: Ech0 Missing Authorization On Dashboard Log Vulnerability
MODERATE
Advisory Summary
GHSA-cp79-9mwr-wr49 is a MODERATE (CVSS 6.5) missing authorization on dashboard log vulnerability (CWE-862: Missing Authorization) affecting Ech0 libraries in the Go ecosystem. The issue involves missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs. Remediation is available by upgrading affected packages to version 4.3.5.
GHSA-cp79-9mwr-wr49 at a Glance
CVE Identifier
N/A
GHSA Identifier
GHSA-cp79-9mwr-wr49
Severity
MODERATE
CVSS v3.1 Base Score
6.5
CWE Classification
CWE-862: Missing Authorization
Affected Product
Ech0
Package Ecosystem
Go
Published Date
Last Updated
Security Impact
CVSS: 6.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Attack Vector
Network (AV:N)
Attack Complexity
Low (AC:L)
Privileges Required
Low (PR:L)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
High (C:H)
Integrity
None (I:N)
Availability
None (A:N)
How to Fix GHSA-cp79-9mwr-wr49
To remediate this vulnerability, upgrade all affected Ech0 dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
github.com/lin-snow/ech0
fixed: 4.3.5
Upgrade github.com/lin-snow/ech0 to 4.3.5
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/lin-snow/ech0How to Check if You Are Affected
To determine whether your application is affected by GHSA-cp79-9mwr-wr49, inspect your project dependencies for Ech0:
inspect dependencies for github.com/lin-snow/ech0Analyze the terminal output to locate any version of Ech0 in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.3.5), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-862: Missing Authorization, where the product does not perform an authorization check when an actor attempts to access a resource or perform an action. In Ech0, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
## Summary
Ech0 allows any authenticated user to read historical system logs and subscribe to live log streams because the dashboard log endpoints validate only that a JWT is present and valid, but do not require an administrator role or privileged scope.
## Impact
Any valid user session can access `GET /api/system/logs` and can also connect to the SSE and WebSocket log streaming endpoints. This exposes operational log data to low-privilege users. Depending on deployment and logging practices, the returned logs may include internal file paths, stack traces, admin activity, background job output, internal URLs, and other sensitive operational context. This creates a post-authentication information disclosure primitive that can materially aid follow-on attacks.
## Details
The issue is caused by an authorization gap between route registration, handler logic, and the service layer.
`internal/router/dashboard.go` registers the log endpoints on authenticated router groups, but does not apply any admin-only authorization middleware:
```go
func setupDashboardRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) {
// Auth
appRouterGroup.AuthRouterGroup.GET("/system/logs", h.DashboardHandler.GetSystemLogs())
appRouterGroup.AuthRouterGroup.GET("/system/logs/stream", h.DashboardHandler.SSESubscribeSystemLogs())
appRouterGroup.WSRouterGroup.GET("/system/logs", h.DashboardHandler.WSSubscribeSystemLogs())
}
```
`internal/handler/dashboard/dashboard.go` returns log data directly and the SSE/WS handlers only check whether `jwtUtil.ParseToken(token)` succeeds:
```go
func (dashboardHandler *DashboardHandler) GetSystemLogs() gin.HandlerFunc {
return res.Execute(func(ctx *gin.Context) res.Response {
logs, err := dashboardHandler.dashboardService.GetSystemLogs(service.SystemLogQuery{
Tail: tail,
Level: ctx.Query("level"),
Keyword: ctx.Query("keyword"),
})
if err != nil {
return res.Response{Err: err}
}
return res.Response{
Data: logs,
Msg: "获取系统日志成功",
}
})
}
```
`internal/service/dashboard/dashboard.go` exposes the log backend without adding a compensating admin check:
```go
func (s *DashboardService) GetSystemLogs(query SystemLogQuery) ([]logUtil.LogEntry, error) {
tail := query.Tail
if tail <= 0 {
tail = 200
}
return logUtil.QueryLogFileTail(logUtil.CurrentLogFilePath(), tail, query.Level, query.Keyword)
}
```
Affected endpoints:
- `GET /api/system/logs`
- `GET /api/system/logs/stream?token=...`
- `GET /ws/system/logs?token=...`
## Proof of concept
### 1. Start the app
```bash
docker run -d \
--name ech0 \
-p 6277:6277 \
-v /opt/ech0/data:/app/data \
-e JWT_SECRET="Hello Echos" \
sn0wl1n/ech0:latest
```
### 2. Initialize an owner account and register a normal user
```bash
curl -sS -X POST "http://127.0.0.1:6277/api/init/owner" \
-H 'Content-Type: application/json' \
-d '{"username":"owner","password":"ownerpass","email":"owner@example.com"}'
curl -sS -X POST "http://127.0.0.1:6277/api/register" \
-H 'Content-Type: application/json' \
-d '{"username":"winky","password":"winkypass","email":"winky@example.com"}'
```
### 3. Log in as the non-admin user and request the system log endpoint
```bash
winky_token=$(
curl -sS -X POST "http://127.0.0.1:6277/api/login" \
-H 'Content-Type: application/json' \
-d '{"username":"winky","password":"winkypass"}' \
| sed -n 's/.*"data":"\([^"]*\)".*/\1/p'
)
curl -sS "http://127.0.0.1:6277/api/system/logs" \
-H "Authorization: Bearer $winky_token"
```
Observed response: the non-admin user receives 200 OK and a JSON response containing entries from `app.log`
<img width="1073" height="183" alt="image" src="https://github.com/user-attachments/assets/f0a836fa-121f-4fb7-a94c-92344d9aedd8" />
The same missing-authorization pattern also affects:
- `GET /api/system/logs/stream?token=<non-admin-token>`
- `GET /ws/system/logs?token=<non-admin-token>`
## Recommended fix
Require an explicit admin-only scope on all dashboard log routes and enforce the same requirement in the service layer.
Suggested change in `internal/router/dashboard.go`:
```go
import (
"github.com/lin-snow/ech0/internal/handler"
"github.com/lin-snow/ech0/internal/middleware"
authModel "github.com/lin-snow/ech0/internal/model/auth"
)
func setupDashboardRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) {
appRouterGroup.AuthRouterGroup.GET(
"/system/logs",
middleware.RequireScopes(authModel.ScopeAdminSettings),
h.DashboardHandler.GetSystemLogs(),
)
appRouterGroup.AuthRouterGroup.GET(
"/system/logs/stream",
middleware.RequireScopes(authModel.ScopeAdminSettings),
h.DashboardHandler.SSESubscribeSystemLogs(),
)
appRouterGroup.WSRouterGroup.GET(
"/system/logs",
middleware.RequireScopes(authModel.ScopeAdminSettings),
h.DashboardHandler.WSSubscribeSystemLogs(),
)
}
```
Suggested defense-in-depth change in the service layer:
```go
func (s *DashboardService) GetSystemLogs(ctx context.Context, query SystemLogQuery) ([]logUtil.LogEntry, error) {
if err := s.ensureAdmin(ctx); err != nil {
return nil, err
}
tail := query.Tail
if tail <= 0 {
tail = 200
}
return logUtil.QueryLogFileTail(logUtil.CurrentLogFilePath(), tail, query.Level, query.Keyword)
}
```
GHSA-cp79-9mwr-wr49 Affected Ech0 Versions
1 component(s)
Fixed Versions:
4.3.5
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/lin-snow/ech0
|
Go |
< 4.3.5
|
4.3.5
|
References
Frequently Asked Questions
What is GHSA-cp79-9mwr-wr49?
GHSA-cp79-9mwr-wr49 is a security vulnerability in Ech0 involving Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs under CWE-862: Missing Authorization.
Which Ech0 versions are affected?
Affected versions include releases prior to 4.3.5 across affected packages: github.com/lin-snow/ech0.
What version fixes GHSA-cp79-9mwr-wr49?
Upgrading to 4.3.5 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/lin-snow/ech0 affected?
Yes, github.com/lin-snow/ech0 is affected in releases prior to 4.3.5. Upgrade your dependency to 4.3.5 or later.
What is the CVSS score of GHSA-cp79-9mwr-wr49?
GHSA-cp79-9mwr-wr49 has a CVSS v3.1 base score of 6.5 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
What CWE is associated with GHSA-cp79-9mwr-wr49?
GHSA-cp79-9mwr-wr49 is classified under CWE-862: Missing Authorization (The product does not perform an authorization check when an actor attempts to access a resource or perform an action.).
How can I check Go dependencies for GHSA-cp79-9mwr-wr49?
Run the dependency tree command: 'inspect dependencies for github.com/lin-snow/ech0'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-cp79-9mwr-wr49",
"modified" : "2026-04-10T19:40:02Z",
"published" : "2026-04-10T19:40:02Z",
"aliases" : [ ],
"summary" : "Ech0: Missing authorization on dashboard log endpoints allows low-privilege users to access sensitive system logs",
"details" : "## Summary\n\nEch0 allows any authenticated user to read historical system logs and subscribe to live log streams because the dashboard log endpoints validate only that a JWT is present and valid, but do not require an administrator role or privileged scope.\n\n## Impact\n\nAny valid user session can access `GET /api/system/logs` and can also connect to the SSE and WebSocket log streaming endpoints. This exposes operational log data to low-privilege users. Depending on deployment and logging practices, the returned logs may include internal file paths, stack traces, admin activity, background job output, internal URLs, and other sensitive operational context. This creates a post-authentication information disclosure primitive that can materially aid follow-on attacks.\n\n## Details\n\nThe issue is caused by an authorization gap between route registration, handler logic, and the service layer.\n\n`internal/router/dashboard.go` registers the log endpoints on authenticated router groups, but does not apply any admin-only authorization middleware:\n\n```go\nfunc setupDashboardRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) {\n\t// Auth\n\tappRouterGroup.AuthRouterGroup.GET(\"/system/logs\", h.DashboardHandler.GetSystemLogs())\n\tappRouterGroup.AuthRouterGroup.GET(\"/system/logs/stream\", h.DashboardHandler.SSESubscribeSystemLogs())\n\tappRouterGroup.WSRouterGroup.GET(\"/system/logs\", h.DashboardHandler.WSSubscribeSystemLogs())\n}\n```\n\n`internal/handler/dashboard/dashboard.go` returns log data directly and the SSE/WS handlers only check whether `jwtUtil.ParseToken(token)` succeeds:\n\n```go\nfunc (dashboardHandler *DashboardHandler) GetSystemLogs() gin.HandlerFunc {\n\treturn res.Execute(func(ctx *gin.Context) res.Response {\n\t\tlogs, err := dashboardHandler.dashboardService.GetSystemLogs(service.SystemLogQuery{\n\t\t\tTail: tail,\n\t\t\tLevel: ctx.Query(\"level\"),\n\t\t\tKeyword: ctx.Query(\"keyword\"),\n\t\t})\n\t\tif err != nil {\n\t\t\treturn res.Response{Err: err}\n\t\t}\n\t\treturn res.Response{\n\t\t\tData: logs,\n\t\t\tMsg: \"获取系统日志成功\",\n\t\t}\n\t})\n}\n```\n\n`internal/service/dashboard/dashboard.go` exposes the log backend without adding a compensating admin check:\n\n```go\nfunc (s *DashboardService) GetSystemLogs(query SystemLogQuery) ([]logUtil.LogEntry, error) {\n\ttail := query.Tail\n\tif tail <= 0 {\n\t\ttail = 200\n\t}\n\treturn logUtil.QueryLogFileTail(logUtil.CurrentLogFilePath(), tail, query.Level, query.Keyword)\n}\n```\n\nAffected endpoints:\n\n- `GET /api/system/logs`\n- `GET /api/system/logs/stream?token=...`\n- `GET /ws/system/logs?token=...`\n\n\n## Proof of concept\n\n### 1. Start the app\n\n```bash\ndocker run -d \\\n --name ech0 \\\n -p 6277:6277 \\\n -v /opt/ech0/data:/app/data \\\n -e JWT_SECRET=\"Hello Echos\" \\\n sn0wl1n/ech0:latest\n```\n\n### 2. Initialize an owner account and register a normal user\n\n```bash\ncurl -sS -X POST \"http://127.0.0.1:6277/api/init/owner\" \\\n -H 'Content-Type: application/json' \\\n -d '{\"username\":\"owner\",\"password\":\"ownerpass\",\"email\":\"owner@example.com\"}'\n\ncurl -sS -X POST \"http://127.0.0.1:6277/api/register\" \\\n -H 'Content-Type: application/json' \\\n -d '{\"username\":\"winky\",\"password\":\"winkypass\",\"email\":\"winky@example.com\"}'\n```\n\n### 3. Log in as the non-admin user and request the system log endpoint\n\n```bash\nwinky_token=$(\n curl -sS -X POST \"http://127.0.0.1:6277/api/login\" \\\n -H 'Content-Type: application/json' \\\n -d '{\"username\":\"winky\",\"password\":\"winkypass\"}' \\\n | sed -n 's/.*\"data\":\"\\([^\"]*\\)\".*/\\1/p'\n)\n\ncurl -sS \"http://127.0.0.1:6277/api/system/logs\" \\\n -H \"Authorization: Bearer $winky_token\"\n```\n\nObserved response: the non-admin user receives 200 OK and a JSON response containing entries from `app.log`\n\n<img width=\"1073\" height=\"183\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f0a836fa-121f-4fb7-a94c-92344d9aedd8\" />\n\n\nThe same missing-authorization pattern also affects:\n\n- `GET /api/system/logs/stream?token=<non-admin-token>`\n- `GET /ws/system/logs?token=<non-admin-token>`\n\n\n## Recommended fix\n\nRequire an explicit admin-only scope on all dashboard log routes and enforce the same requirement in the service layer.\n\nSuggested change in `internal/router/dashboard.go`:\n\n```go\nimport (\n\t\"github.com/lin-snow/ech0/internal/handler\"\n\t\"github.com/lin-snow/ech0/internal/middleware\"\n\tauthModel \"github.com/lin-snow/ech0/internal/model/auth\"\n)\n\nfunc setupDashboardRoutes(appRouterGroup *AppRouterGroup, h *handler.Bundle) {\n\tappRouterGroup.AuthRouterGroup.GET(\n\t\t\"/system/logs\",\n\t\tmiddleware.RequireScopes(authModel.ScopeAdminSettings),\n\t\th.DashboardHandler.GetSystemLogs(),\n\t)\n\tappRouterGroup.AuthRouterGroup.GET(\n\t\t\"/system/logs/stream\",\n\t\tmiddleware.RequireScopes(authModel.ScopeAdminSettings),\n\t\th.DashboardHandler.SSESubscribeSystemLogs(),\n\t)\n\tappRouterGroup.WSRouterGroup.GET(\n\t\t\"/system/logs\",\n\t\tmiddleware.RequireScopes(authModel.ScopeAdminSettings),\n\t\th.DashboardHandler.WSSubscribeSystemLogs(),\n\t)\n}\n```\n\nSuggested defense-in-depth change in the service layer:\n\n```go\nfunc (s *DashboardService) GetSystemLogs(ctx context.Context, query SystemLogQuery) ([]logUtil.LogEntry, error) {\n\tif err := s.ensureAdmin(ctx); err != nil {\n\t\treturn nil, err\n\t}\n\n\ttail := query.Tail\n\tif tail <= 0 {\n\t\ttail = 200\n\t}\n\treturn logUtil.QueryLogFileTail(logUtil.CurrentLogFilePath(), tail, query.Level, query.Keyword)\n}\n```",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/lin-snow/ech0"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "4.3.5"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/lin-snow/Ech0/security/advisories/GHSA-cp79-9mwr-wr49"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/lin-snow/Ech0"
}, {
"type" : "WEB",
"url" : "https://github.com/lin-snow/Ech0/releases/tag/v4.3.5"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-862" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-04-10T19:40:02Z",
"nvd_published_at" : null
}
}