CyberRota Analysis
AI-GeneratedEch0 versions prior to 4.4.3 are vulnerable due to inadequate enforcement of administrator authorization on dashboard log endpoints, enabling any authenticated user to access sensitive system logs. This flaw allows attackers with valid sessions to exploit endpoints like GET /api/system/logs and subscribe to log streams, potentially exposing critical operational data such as file paths and internal URLs. Organizations utilizing Ech0 should prioritize patching this vulnerability to mitigate the risk of unauthorized data access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers with valid user sessions can query GET /api/system/logs and subscribe to SSE and WebSocket log streams to retrieve sensitive operational data including file paths, stack traces, and internal URLs.