russell@unturf.com 9a78d1afbe feat: add 15 outreach docs (15 defects) for 1-patch projects

0ad (4), aranym, ardour, argo-cd, aria2, azahar, bcoin, bind9,
btcpayserver (3), bullet3. Mix of CWE-407 and CWE-312.

2026-04-14 14:33:17 -04:00

2.2 KiB

Raw Permalink Blame History

0 A.D. — CWE-312 Disclosure Brief (0ad-0004)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One CWE-312 (Cleartext Storage of Sensitive Information) defect in 0 A.D.'s multiplayer lobby system. Lobby authentication tokens are logged verbatim in two locations, exposing session credentials in log files.

The Defect

0ad-0004 (PATCHED — MEDIUM): source/lobby/XmppClient.cpp:958 and source/network/NetServer.cpp:874

// In XmppClient — lobby auth token logged in cleartext:
LOGMESSAGE("XmppClient: Received lobby auth: %s from %s",
           lobbyAuth->m_Token.to_string(), iq.from().username());

// In NetServer — lobby auth token logged in cleartext:
LOGMESSAGE("Net Server: Received lobby auth message from %s with %s",
           name, token);

Both log statements write the full authentication token value to the game's log file. Anyone with access to the log file (crash reports, shared debug logs, pastebin posts) can extract session credentials.

Impact

0 A.D. has an active multiplayer community using the lobby system for matchmaking. Players routinely share log files when reporting issues. Lobby auth tokens in logs expose session credentials to anyone who reads the log, enabling session hijacking.

The Fix

Redact token values in log output:

// Before
LOGMESSAGE("XmppClient: Received lobby auth: %s from %s",
           lobbyAuth->m_Token.to_string(), iq.from().username());

// After
// CWE-312 fix: redact token values in log output.
LOGMESSAGE("XmppClient: Received lobby auth: [REDACTED] from %s",
           iq.from().username());

Patch

Fix available: defects/0ad-0004/patch/0ad-0004.patch

Two-file patch across XmppClient.cpp and NetServer.cpp. Replaces token format strings with [REDACTED] in both log statements.

What We Ask

A patch is ready for review.

Confirm receipt and assign an issue reference (0ad/0ad or Wildfire Games Trac).
Assess severity — lobby auth tokens exposed in log files.
Coordinate a disclosure date — we target 90 days from first contact.
We will credit the 0 A.D. team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.2 KiB Raw Permalink Blame History