java-topology/defects/dogecoin-0001/SUMMARY.md

dogecoin-0001: SOCKS5 Proxy Password Logged in Plaintext (CWE-312 / MOAD-0004)

Location

src/netbase.cpp:350

Pattern

LogPrint("proxy", "SOCKS5 sending proxy authentication %s:%s\n", auth->username, auth->password);

The SOCKS5 proxy authentication password is logged verbatim to the debug log when the "proxy" log category is enabled. This means the credential appears in debug.log in plaintext, readable by any process or user with access to the data directory.

Severity

MEDIUM. Requires -debug=proxy or -debug=1 to trigger, but those are common debugging flags. The password is written to persistent storage (log file).

Fix

Mask the password in the log output. Only the username is necessary for diagnostic purposes.

MOAD

0004 (The Logged Secret, CWE-312)