4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-xvp7-8vm8-xfxx

GHSA-xvp7-8vm8-xfxx: Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Summary

The GoCardless components in Actualbudget in are logging responses to STDOUT in a parsed format using console.logand console.debug (Which in this version of node is an alias for console.log). This is exposing sensitive information in log files including, but not limited to:

Gocardless bearer tokens.
Account IBAN and Bank Account numbers.
PII of the account holder.
Transaction details (Payee bank information, Recipient account numbers, Transaction IDs)...

Details

Whenever GoCardless responds to a request, the payload is printed to the debug log: https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/banks/integration-bank.js#L25-L27

This in turn logs the following information to Docker (all values removed here. These fields are possibly dependent on what is returned by each institution so may differ):

{
  "account": {
    "resourceId": "",
    "iban": "",
    "bban": "",
    "currency": "",
    "name": "<full legal name in the bank>",
    "product": "",
    "status": "",
    "bic": "",
    "usage": "",
    "id": "",
    "created": "",
    "last_accessed": "",
    "institution_id": "",
    "owner_name": "",
    "institution": {
      "id": "",
      "name": "",
      "bic": "",
      "transaction_total_days": "",
      "countries": [
        ""
      ],
      "logo": "",
      "max_access_valid_for_days": "",
      "supported_features": [
        "",
        "",
        ""
      ],
      "identification_codes": []
    }
  }
}

https://github.com/actualbudget/actual/blob/36c40d90d2fe09eb1f25a6e2f77f6dd40638b267/packages/sync-server/src/app-gocardless/banks/integration-bank.js#L83-L85

This is the first of the 10 transactions:

{
  "top10Transactions": [{
    "transactionId": "",
    "entryReference": "",
    "bookingDate": "",
    "valueDate": "",
    "transactionAmount": {
      "amount": "",
      "currency": ""
    },
    "creditorName": "",
    "creditorAccount": {
      "bban": ""
    },
    "debtorName": "",
    "debtorAccount": {
      "bban": ""
    },
    "remittanceInformationUnstructured": "",
    "remittanceInformationStructuredArray": [
      {"reference": "", "referenceType": ""}
    ],
    "additionalInformation": "",
    "proprietaryBankTransactionCode": "",
    "debtorAgent": "",
    "internalTransactionId": "",
    "payeeName": "",
    "date": ""
  }]
}

Miggo Vulnerability Database

→

GHSA-xvp7-8vm8-xfxx

GHSA-xvp7-8vm8-xfxx:

4.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@actual-app/sync-server	npm	<= 25.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is caused by excessive and insecure logging of sensitive information within the sync-server package. The analysis of the patch commit 97482a082d502887ef22514b93e35e4c67f4f30f reveals multiple locations where console.log and console.debug were used to print entire objects or sensitive strings.

The root cause is twofold:

Direct Logging of Sensitive Data: Functions like normalizeAccount, sortTransactions, and calculateStartingBalance in integration-bank.js and parseAccessKey in app-simplefin.js were explicitly logging sensitive data such as account details, transaction histories, and access keys for debugging purposes.
Indirect Logging via Error Handling: The error handling logic in app-gocardless.js and the handleError utility function were using util.inspect(error, { depth: null }) to log the entire error object upon failure. As shown in the vulnerability report, when an API call failed, the logged error object included the original request configuration, which contained the Authorization header with the bearer token.

The patch addresses these issues by removing the debug logging and changing the error logging to only output the error message instead of the full object. Any environment running the vulnerable version of @actual-app/sync-server is at risk of exposing highly sensitive financial and personal data in its logs.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

Something went wrong ServiceError: Institution service unavailable at handleGoCardlessError (file:///app/src/app-gocardless/services/gocardless-service.js:59:13) at Object.getTransactions (file:///app/src/app-gocardless/services/gocardless-service.js:530:7) at process.processTicksAndRejections (node:internal/process/task_queues:95:5) at async Object.getNormalizedTransactions (file:///app/src/app-gocardless/services/gocardless-service.js:267:26) at async file:///app/src/app-gocardless/app-gocardless.js:186:13 { details: h [AxiosError]: Request failed with status code 503 at te (file:///app/node_modules/nordigen-node/dist/index.esm.js:13:914) at IncomingMessage.<anonymous> (file:///app/node_modules/nordigen-node/dist/index.esm.js:17:16315) at IncomingMessage.emit (node:events:529:35) at endReadableNT (node:internal/streams/readable:1400:12) at process.processTicksAndRejections (node:internal/process/task_queues:82:21) { code: 'ERR_BAD_RESPONSE', config: { transitional: { silentJSONParsing: true, forcedJSONParsing: true, clarifyTimeoutError: false }, adapter: [ 'xhr', 'http' ], transformRequest: [ [Function (anonymous)] ], transformResponse: [ [Function (anonymous)] ], timeout: 0, xsrfCookieName: 'XSRF-TOKEN', xsrfHeaderName: 'X-XSRF-TOKEN', maxContentLength: -1, maxBodyLength: -1, env: { FormData: [Function: _] { LINE_BREAK: '\r\n', DEFAULT_CONTENT_TYPE: 'application/octet-stream' }, Blob: [class Blob] }, validateStatus: [Function: validateStatus], headers: T [AxiosHeaders] { Accept: 'application/json', 'Content-Type': 'application/json', 'User-Agent': 'Nordigen-Node-v2', 'Authorization': 'Bearer eyJ0eXAi... (the full token is in the response)', 'Accept-Encoding': 'gzip, compress, deflate, br' }, method: 'get', url: URL { href: 'https://bankaccountdata.gocardless.com/api/v2/accounts/<Account id Was Here>?date_from=2024-12-22', origin: 'https://bankaccountdata.gocardless.com', protocol: 'https:', username: '', password: '', host: 'bankaccountdata.gocardless.com', hostname: 'bankaccountdata.gocardless.com', port: '', pathname: '/api/v2/accounts/<Account id Was Here>/transactions', search: '?date_from=2024-12-22', searchParams: URLSearchParams { 'date_from' => '2024-12-22' }, hash: '' }, data: undefined },

4.2

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-xvp7-8vm8-xfxx: Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Summary

Details

GHSA-xvp7-8vm8-xfxx:

4.2

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Technical Details

4.2

4.2

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

GHSA-xvp7-8vm8-xfxx: Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Summary

Details

PoC

Impact

4.2

-

Basic Information

Basic Information

Concerned about an active attack path?

GHSA-xvp7-8vm8-xfxx: Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Summary

Details

GHSA-xvp7-8vm8-xfxx:

4.2

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

4.2

4.2

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

GHSA-xvp7-8vm8-xfxx: Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers

Summary

Details

PoC

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI