28 lines
1.4 KiB
Diff
28 lines
1.4 KiB
Diff
# UNDF: UNDF-2026-000001174
|
|
# UNDF: (leave blank)
|
|
# CWE-312: Cleartext Storage of Sensitive Information
|
|
# VLC SMB1 DSM access module logs SMB credentials (username + domain) at WARN level.
|
|
# msg_Warn( p_access, "Creds: username = '%s', domain = '%s'", psz_login, psz_domain )
|
|
# This line runs on every successful SMB1 login, writing plaintext credentials to
|
|
# the VLC log file, syslog, or any log sink configured by our user.
|
|
# VLC debug logs are routinely shared in bug reports, exposing SMB usernames and
|
|
# domain names to third parties.
|
|
# Fix: remove our credential log line entirely. Login success is already implicit
|
|
# from reaching this point without error. Domain and username do not need to be
|
|
# re-announced in the log after authentication completes.
|
|
# Severity: MEDIUM. Username + domain logged, not password. Still a CWE-312 defect
|
|
# because domain\username is often sufficient to enumerate valid accounts and
|
|
# facilitates phishing/lateral movement in corporate environments.
|
|
--- a/modules/access/dsm/access.c
|
|
+++ b/modules/access/dsm/access.c
|
|
@@ -582,9 +582,6 @@ static int Open( vlc_object_t *p_this )
|
|
if( smb_session_is_guest( p_sys->p_session ) == 1 )
|
|
{
|
|
msg_Warn( p_access, "Login failure but you were logged in as a Guest");
|
|
b_guest = true;
|
|
}
|
|
|
|
- msg_Warn( p_access, "Creds: username = '%s', domain = '%s'",
|
|
- psz_login, psz_domain );
|
|
if( !b_guest )
|
|
vlc_credential_store( &credential, p_access );
|