59 lines
2.8 KiB
Diff
59 lines
2.8 KiB
Diff
# UNDF: UNDF-2026-000001181
|
|
--- a/subsys/net/lib/wifi_credentials/wifi_credentials_shell.c
|
|
+++ b/subsys/net/lib/wifi_credentials/wifi_credentials_shell.c
|
|
@@ -49,17 +49,17 @@ static void print_network_info(void *cb_arg, const char *ssid, size_t ssid_len)
|
|
# Defect ID: zephyr-0001
|
|
# MOAD: 0004
|
|
# Severity: HIGH
|
|
# CVE class: CWE-312 Cleartext Storage/Exposure of Sensitive Information
|
|
#
|
|
# Root cause: print_network_info() in wifi_credentials_shell.c retrieves stored
|
|
# WiFi credentials and prints the plaintext PSK/password unconditionally via
|
|
# shell_fprintf when the "wifi cred list" shell command is run:
|
|
#
|
|
# line 57-59: shell_fprintf(sh, ..., ", password: \"%.*s\", password_len: %d",
|
|
# ..., creds.password, creds.password_len)
|
|
#
|
|
# For WPA2-PSK, WPA2-PSK-SHA256, SAE, and WPA-PSK security types the password
|
|
# is emitted verbatim to the shell. Additionally for EAP-TLS enterprise mode:
|
|
#
|
|
# line 65-68: shell_fprintf(sh, ..., ", key_passwd: \"%.*s\"...",
|
|
# ..., creds.header.key_passwd, ...)
|
|
#
|
|
# This exposes the private-key passphrase for enterprise TLS connections.
|
|
#
|
|
# On embedded systems with serial console or UART shell, any observer with
|
|
# console access sees live credentials. On boards with logging backends that
|
|
# write to flash or network syslog the credential is persisted in cleartext.
|
|
#
|
|
# Fix: replace the password and key_passwd fields with a redacted marker
|
|
# ("[redacted]") when printing via the shell. The password_len is still
|
|
# printed so the operator can verify a credential is set without exposing value.
|
|
|
|
+static const char REDACTED[] = "[redacted]";
|
|
+
|
|
static void print_network_info(void *cb_arg, const char *ssid, size_t ssid_len)
|
|
{
|
|
int ret = 0;
|
|
@@ -53,12 +53,12 @@ static void print_network_info(void *cb_arg, const char *ssid, size_t ssid_len)
|
|
if (creds.header.type == WIFI_SECURITY_TYPE_PSK ||
|
|
creds.header.type == WIFI_SECURITY_TYPE_PSK_SHA256 ||
|
|
creds.header.type == WIFI_SECURITY_TYPE_SAE ||
|
|
creds.header.type == WIFI_SECURITY_TYPE_WPA_PSK) {
|
|
shell_fprintf(sh, SHELL_VT100_COLOR_DEFAULT,
|
|
- ", password: \"%.*s\", password_len: %d", (int)creds.password_len,
|
|
- creds.password, creds.password_len);
|
|
+ ", password: %s, password_len: %d",
|
|
+ REDACTED, creds.password_len);
|
|
}
|
|
|
|
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
|
|
if (creds.header.type == WIFI_SECURITY_TYPE_EAP_TLS) {
|
|
if (creds.header.key_passwd_length > 0) {
|
|
shell_fprintf(sh, SHELL_VT100_COLOR_DEFAULT,
|
|
- ", key_passwd: \"%.*s\", key_passwd_len: %d",
|
|
- creds.header.key_passwd_length, creds.header.key_passwd,
|
|
- creds.header.key_passwd_length);
|
|
+ ", key_passwd: %s, key_passwd_len: %d",
|
|
+ REDACTED, creds.header.key_passwd_length);
|
|
}
|