CVE-2023-22481: Sensitive information exposure in the logs of greader API

Summary

When using the greader API, the provided password is logged in clear in users/_/log_api.txt in the case where the authentication fails.

Details

The issues occurs in authorizationToUser() in greader.php.
If there is an issue with the request or the credentials, unauthorized() or badRequest() is called.
Both these functions are printing the return of debugInfo() in the logs. debugInfo() will return the content of the request, eventually containing something like

    [_POST] => Array
        (
            [Email] => me
            [Passwd] => test
            [T] =>
        )

    [_COOKIE] => Array
        (
        )

    [INPUT] => Email=me&Passwd=test&T=

By default, this will be saved in users/_/log_api.txt and if the const COPY_LOG_TO_SYSLOG is true, in syslogs as well.

PoC

This can be reproduced as follows:
Try to log in using the Google compatible API and wrong credentials.
I used ReadKit (iOS version 3.1.1) and FreshRSS (production env) version 1.21.0-dev (docker image freshrss/freshrss:edge)

Impact

The issue requires to have access to logs produced by FreshRSS (potentially any logged user on the machine, since the default configuration is also writing logs into syslog)

Using the information from the logs, a malicious individual could get users’ API keys (would be displayed if the users fills in a bad username) or passwords (it is easy to make a mistake and try to log in with the password rather than with the API key)