java-topology/defects/zesarux-0001/patch/zesarux-0001.patch

67 lines
3.3 KiB
Diff

# UNDF: UNDF-2026-000001183
# UNDF: UNDF-2026-XXXXXXXXX
--- a/src/zrcp/remote.c
+++ b/src/zrcp/remote.c
@@ -3881,7 +3881,9 @@ static void process_remote_command(int misocket, char *comando)
int longitud_comando=strlen(comando);
if (longitud_comando<DEBUG_MAX_MESSAGE_LENGTH) {
- debug_printf (VERBOSE_DEBUG,"Remote command: length: %d [%s]",longitud_comando,comando);
+ /* Do not log the full command string verbatim — ZENG commands carry
+ creator_pass / user_pass as inline parameters (CWE-312). */
+ debug_printf (VERBOSE_DEBUG,"Remote command: length: %d",longitud_comando);
}
else {
@@ -3960,11 +3962,11 @@ static void process_remote_command(int misocket, char *comando)
debug_printf (VERBOSE_DEBUG,"Remote command without parameters: length: %d [%s]",strlen(comando_sin_parametros),comando_sin_parametros);
if (strlen(parametros)<DEBUG_MAX_MESSAGE_LENGTH) {
- debug_printf (VERBOSE_DEBUG,"Remote command parameters: length: %d [%s]",strlen(parametros),parametros);
+ /* Suppress parameter values — first token is creator_pass or user_pass
+ for most ZENG multiplayer commands (CWE-312). */
+ debug_printf (VERBOSE_DEBUG,"Remote command parameters: length: %d [REDACTED]",strlen(parametros));
}
else {
- debug_printf (VERBOSE_DEBUG,"Remote command parameters: length: %d",strlen(parametros));
+ debug_printf (VERBOSE_DEBUG,"Remote command parameters: length: %d [REDACTED]",strlen(parametros));
}
# Defect: zesarux-0001
# MOAD: 0004 (CWE-312 — Cleartext Storage of Sensitive Information)
# File: src/zrcp/remote.c
# Function: process_remote_command (inferred from context)
# Lines: 3884, 3963, 3966
#
# Description:
# The ZRCP remote command protocol processes ZENG (ZEsarUX aNd Games) online
# multiplayer commands. Dozens of ZENG commands carry authentication tokens as
# inline parameters: creator_pass (room owner password) and user_pass (session
# token). Examples include authorize-join, destroy-room, get-keys, kick, leave,
# put-snapshot, rename-room, send-keys, send-message, set-max-players, and more.
#
# When VERBOSE_DEBUG logging is active, the ZRCP dispatcher logs:
# 1. The full raw command string at line 3884:
# "Remote command: length: %d [%s]" -- exposes creator_pass/user_pass
# 2. The parameter string at line 3963:
# "Remote command parameters: length: %d [%s]" -- exposes the token
# directly as the first token in parametros
#
# Any log file, terminal capture, or remote log aggregator that captures
# VERBOSE_DEBUG output will contain the plaintext session credentials.
#
# Severity: MEDIUM
# - Requires VERBOSE_DEBUG log level to be active (debug builds / --verbose-debug)
# - Exposes multiplayer session tokens (creator_pass, user_pass) that grant
# control over online game rooms hosted via ZENG server mode
# - Authentication tokens are typically short random strings, not cryptographic
# secrets, but exposure allows room hijacking
#
# Fix:
# Remove the command body from the full-command log message (length only).
# Replace the parameter value log with a [REDACTED] placeholder that preserves
# the length diagnostic without exposing credential content.
#
# References:
# - CWE-312: Cleartext Storage of Sensitive Information
# - ZENG command reference: src/zrcp/remote.c lines 920-962