CVE-2023-34097: 
NixOS vulnerability analysis and mitigation

Hoppscotch, an open source API development ecosystem, was found to expose database passwords in logs when showing the database connection string in versions prior to 2023.4.5. The vulnerability (CVE-2023-34097) was discovered and disclosed in June 2023. The issue affects all versions of Hoppscotch up to and including version 2023.4.4 (GitHub Advisory).

The vulnerability is classified as CWE-532 (Insertion of Sensitive Information into Log File). When running the application, the database connection string containing credentials was being logged, exposing sensitive authentication information. The vulnerability received a CVSS v3.1 base score of 7.8 (High) from GitHub and 8.8 (High) from NIST with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

Attackers with access to read system logs would be able to elevate privileges with full access to the database. This could lead to unauthorized database access, potential data breaches, and compromise of sensitive information stored in the database (GitHub Advisory).

The vulnerability can be exploited by anyone with access to server logs. The attack complexity is considered low as it requires no special conditions or user interaction to exploit. The vulnerability requires local access to the system logs to be exploited (GitHub Advisory).

Users are advised to upgrade to version 2023.4.5 or later which removes the database connection string from the logs. The fix was implemented by removing the logging of DATABASE_URL from the main.ts file (GitHub Patch). There are no known workarounds for this vulnerability.