Description
The SMTP password configured via Settings → Mail → Mail Configuration (backend/system/settings/update/winter/system/mail_settings) is stored in plaintext in the system_settings table (item = 'system_mail_settings'), inside the smtp_password field of the serialized JSON value.
Steps to reproduce
- Go to
Settings → Mail Configuration in the backend.
- Set
Send mode to SMTP and fill in SMTP credentials (host, user, password).
- Save the settings.
- Query the database directly:
SELECT value FROM system_settings WHERE item = 'system_mail_settings';
- Observe that
smtp_password is stored in plaintext, readable by anyone with read access to the database.
Expected behavior
The SMTP password should be encrypted at rest (e.g. using Laravel's Crypt facade / an encryptable attribute on the MailSetting model), similar to how other sensitive credentials are typically handled in the framework.
Actual behavior
The password is stored as plain, human-readable text in the database.
Environment
- Winter CMS version: 1.2
- Laravel version: Laravel Framework 9.52.21 - Winter CMS
- PHP version: 8.4
- Database: PostgreSQL
Security impact
Anyone with read access to the database (backup files, replicas, misconfigured permissions, a compromised low-privilege DB account, etc.) can retrieve the SMTP credentials in plaintext, which could be used to send email as the configured sender or to attempt credential reuse against the mail provider.
Suggested fix
Encrypt the smtp_password field before persisting it (and decrypt on read), consistent with how other sensitive fields are protected elsewhere in the codebase.`
Description
The SMTP password configured via Settings → Mail → Mail Configuration (
backend/system/settings/update/winter/system/mail_settings) is stored in plaintext in thesystem_settingstable (item = 'system_mail_settings'), inside thesmtp_passwordfield of the serialized JSON value.Steps to reproduce
Settings → Mail Configurationin the backend.Send modeto SMTP and fill in SMTP credentials (host, user, password).smtp_passwordis stored in plaintext, readable by anyone with read access to the database.Expected behavior
The SMTP password should be encrypted at rest (e.g. using Laravel's
Cryptfacade / anencryptableattribute on theMailSettingmodel), similar to how other sensitive credentials are typically handled in the framework.Actual behavior
The password is stored as plain, human-readable text in the database.
Environment
Security impact
Anyone with read access to the database (backup files, replicas, misconfigured permissions, a compromised low-privilege DB account, etc.) can retrieve the SMTP credentials in plaintext, which could be used to send email as the configured sender or to attempt credential reuse against the mail provider.
Suggested fix
Encrypt the
smtp_passwordfield before persisting it (and decrypt on read), consistent with how other sensitive fields are protected elsewhere in the codebase.`