russell@unturf.com 652608142a feat: close outreach doc gap — 276 docs (batches 11-16)

All projects with patches now have outreach docs. 276 new docs covering
CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#,
PHP, Ruby, JavaScript, Dart, Erlang, R, and more.

Outreach gap: 276 -> 0.

2026-04-15 13:57:42 -04:00

2.4 KiB

Raw Permalink Blame History

Apache OpenOffice — CWE-312 Disclosure Brief (openoffice-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

WebDAV curl debug callback logs HTTP Authorization headers verbatim when LogLevel::FINEST is enabled. Base64-encoded credentials (HTTP Basic) and Digest response tokens appear in persistent log files readable by any process with log access.

The Defect

openoffice-0002 (PATCHED — MEDIUM): main/ucb/source/ucp/webdav/CurlSession.cxx:336

// curlDebugOutput — logs all HTTP headers at FINEST level:
rtl::OString message(data, size);
m_aLogger.log(LogLevel::FINEST, "$1$ $2$", prefix, message);

When CURLINFO_HEADER_OUT fires, outgoing Authorization: Basic dXNlcjpteXBhc3N3b3Jk headers are written directly to the log. The base64 decodes trivially to user:mypassword. LogLevel::FINEST is user-configurable via Tools > Options > Advanced > Expert Configuration.

Impact

OpenOffice connects to WebDAV servers for remote document storage. Users enable FINEST logging for diagnostics, unknowingly recording all WebDAV credentials in plaintext. Log files persist on disk and may be shared with support teams, uploaded to forums, or collected by backup systems.

The Fix

Strip credential values from outgoing and incoming header lines before logging. Credential-bearing headers (Authorization, Proxy-Authorization, Cookie, X-Auth-Token, Set-Cookie, WWW-Authenticate, Proxy-Authenticate) are logged with <redacted> replacing the value:

// Before
m_aLogger.log(LogLevel::FINEST, "$1$ $2$", prefix, message);

// After
if ((type == CURLINFO_HEADER_IN || type == CURLINFO_HEADER_OUT)
     && lcl_IsCredentialHeader(message))
    m_aLogger.log(LogLevel::FINEST, "$1$ $2$", prefix, lcl_RedactHeader(message));
else
    m_aLogger.log(LogLevel::FINEST, "$1$ $2$", prefix, message);

Patch

Fix available: defects/openoffice-0002/patch/openoffice-0002.patch

Single-file patch in CurlSession.cxx.

What We Ask

A patch is ready for review.

Confirm receipt and assign a Bugzilla issue reference (Apache OpenOffice).
Assess severity — credential exposure requires FINEST log level, but that is a realistic diagnostics scenario.
Coordinate a disclosure date — we target 90 days from first contact.
We will credit the Apache OpenOffice team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

2.4 KiB Raw Permalink Blame History