67 lines
3.3 KiB
Diff
67 lines
3.3 KiB
Diff
# UNDF: UNDF-2026-000001183
|
|
# UNDF: UNDF-2026-XXXXXXXXX
|
|
--- a/src/zrcp/remote.c
|
|
+++ b/src/zrcp/remote.c
|
|
@@ -3881,7 +3881,9 @@ static void process_remote_command(int misocket, char *comando)
|
|
int longitud_comando=strlen(comando);
|
|
|
|
if (longitud_comando<DEBUG_MAX_MESSAGE_LENGTH) {
|
|
- debug_printf (VERBOSE_DEBUG,"Remote command: length: %d [%s]",longitud_comando,comando);
|
|
+ /* Do not log the full command string verbatim — ZENG commands carry
|
|
+ creator_pass / user_pass as inline parameters (CWE-312). */
|
|
+ debug_printf (VERBOSE_DEBUG,"Remote command: length: %d",longitud_comando);
|
|
}
|
|
|
|
else {
|
|
@@ -3960,11 +3962,11 @@ static void process_remote_command(int misocket, char *comando)
|
|
debug_printf (VERBOSE_DEBUG,"Remote command without parameters: length: %d [%s]",strlen(comando_sin_parametros),comando_sin_parametros);
|
|
|
|
if (strlen(parametros)<DEBUG_MAX_MESSAGE_LENGTH) {
|
|
- debug_printf (VERBOSE_DEBUG,"Remote command parameters: length: %d [%s]",strlen(parametros),parametros);
|
|
+ /* Suppress parameter values — first token is creator_pass or user_pass
|
|
+ for most ZENG multiplayer commands (CWE-312). */
|
|
+ debug_printf (VERBOSE_DEBUG,"Remote command parameters: length: %d [REDACTED]",strlen(parametros));
|
|
}
|
|
else {
|
|
- debug_printf (VERBOSE_DEBUG,"Remote command parameters: length: %d",strlen(parametros));
|
|
+ debug_printf (VERBOSE_DEBUG,"Remote command parameters: length: %d [REDACTED]",strlen(parametros));
|
|
}
|
|
|
|
# Defect: zesarux-0001
|
|
# MOAD: 0004 (CWE-312 — Cleartext Storage of Sensitive Information)
|
|
# File: src/zrcp/remote.c
|
|
# Function: process_remote_command (inferred from context)
|
|
# Lines: 3884, 3963, 3966
|
|
#
|
|
# Description:
|
|
# The ZRCP remote command protocol processes ZENG (ZEsarUX aNd Games) online
|
|
# multiplayer commands. Dozens of ZENG commands carry authentication tokens as
|
|
# inline parameters: creator_pass (room owner password) and user_pass (session
|
|
# token). Examples include authorize-join, destroy-room, get-keys, kick, leave,
|
|
# put-snapshot, rename-room, send-keys, send-message, set-max-players, and more.
|
|
#
|
|
# When VERBOSE_DEBUG logging is active, the ZRCP dispatcher logs:
|
|
# 1. The full raw command string at line 3884:
|
|
# "Remote command: length: %d [%s]" -- exposes creator_pass/user_pass
|
|
# 2. The parameter string at line 3963:
|
|
# "Remote command parameters: length: %d [%s]" -- exposes the token
|
|
# directly as the first token in parametros
|
|
#
|
|
# Any log file, terminal capture, or remote log aggregator that captures
|
|
# VERBOSE_DEBUG output will contain the plaintext session credentials.
|
|
#
|
|
# Severity: MEDIUM
|
|
# - Requires VERBOSE_DEBUG log level to be active (debug builds / --verbose-debug)
|
|
# - Exposes multiplayer session tokens (creator_pass, user_pass) that grant
|
|
# control over online game rooms hosted via ZENG server mode
|
|
# - Authentication tokens are typically short random strings, not cryptographic
|
|
# secrets, but exposure allows room hijacking
|
|
#
|
|
# Fix:
|
|
# Remove the command body from the full-command log message (length only).
|
|
# Replace the parameter value log with a [REDACTED] placeholder that preserves
|
|
# the length diagnostic without exposing credential content.
|
|
#
|
|
# References:
|
|
# - CWE-312: Cleartext Storage of Sensitive Information
|
|
# - ZENG command reference: src/zrcp/remote.c lines 920-962
|