In Keyfactor SignServer before version 7.6.0, the ATTRIBUTESFILE attribute in PKCS11CryptoToken can be set to a readable file that is not recognized as a valid attributes file. When this occurs, the system throws an error and logs the content of the file to the application server log. This behavior exposes the contents of arbitrary files accessible by the local JBoss user to anyone who has both administrative access to SignServer and access to read the server logs, such as through remote syslog shipping configurations.

An attacker with SignServer administrative privileges and the ability to read server logs can obtain sensitive information from arbitrary files accessible by the local JBoss user. This could lead to unauthorized disclosure of sensitive data stored on the server. However, exploitation requires both admin access to SignServer and log reading capabilities, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict SignServer administrative access and secure access to server logs to prevent unauthorized reading of sensitive file contents. Monitor for updates from Keyfactor regarding an official fix.