russell@unturf.com 6784cdf1cf feat: add 39 outreach docs (batches 6-8)

Batch 6 (9): dolibarr, jitsi-videobridge, zed, tryton, suricata,
  strawberry, zulip, zesarux, zephyr
Batch 7 (15): xonotic (4), xash3d (3), xenia, xtuple, zabbix (2),
  zathura, zebra, yabause, zephyr-0001
Batch 8 (15): woodpecker (2), wine (4), widelands (3), wesnoth (3),
  wekan (3)

Mix of CWE-407 and CWE-312.

2026-04-14 17:06:28 -04:00

3.2 KiB

Raw Blame History

ZEsarUX — CWE-312 Disclosure Brief

2026-04-13 · Patch available — awaiting upstream merge

Finding

One CWE-312 cleartext credential logging defect in ZEsarUX's ZRCP (ZEsarUX Remote Control Protocol) command dispatcher. Patched. Patch ready for upstream review. The defect fires on every ZENG multiplayer command when VERBOSE_DEBUG logging activates.

The Defect

zesarux-0001 (PATCHED — MEDIUM, CWE-312): src/zrcp/remote.c:3884,3963

// Full command string logged verbatim — exposes creator_pass/user_pass
debug_printf(VERBOSE_DEBUG, "Remote command: length: %d [%s]", longitud_comando, comando);
// ...
// Parameter string logged verbatim — first token is the auth credential
debug_printf(VERBOSE_DEBUG, "Remote command parameters: length: %d [%s]", strlen(parametros), parametros);

The ZRCP dispatcher logs the full raw command string and parameter string at VERBOSE_DEBUG level. ZENG (ZEsarUX aNd Games) online multiplayer commands carry authentication tokens as inline parameters: creator_pass (room owner password) and user_pass (session token). Commands affected include authorize-join, destroy-room, get-keys, kick, leave, put-snapshot, rename-room, send-keys, send-message, set-max-players, and more.

Any log file, terminal capture, or remote log aggregator that captures VERBOSE_DEBUG output contains plaintext session credentials.

Impact

ZEsarUX emulates ZX Spectrum, ZX80/81, Z88, and other Z80-based machines. The ZENG multiplayer system allows online play between emulator instances. When developers or users run with --verbose-debug (common during ZENG server setup and troubleshooting), every multiplayer command logs its authentication credentials to the console and any connected log backend.

The exposure enables room hijacking: an observer with log access can extract creator_pass tokens and take ownership of active game rooms, kick players, or inject game state.

The Fix

Remove the command body from the full-command log message. Replace parameter values with [REDACTED]:

// Before
debug_printf(VERBOSE_DEBUG, "Remote command: length: %d [%s]", longitud_comando, comando);
debug_printf(VERBOSE_DEBUG, "Remote command parameters: length: %d [%s]", strlen(parametros), parametros);

// After
debug_printf(VERBOSE_DEBUG, "Remote command: length: %d", longitud_comando);
debug_printf(VERBOSE_DEBUG, "Remote command parameters: length: %d [REDACTED]", strlen(parametros));

The length diagnostic remains for debugging without exposing credential content.

Patch

Fix available: defects/zesarux-0001/patch/zesarux-0001.patch

Single-file patch in src/zrcp/remote.c. Three log call sites modified: full command body suppressed, parameter values redacted.

What We Ask

Patch ready for review.

Confirm receipt and assign a GitHub issue reference (chernandezba/zesarux).
Assess severity — credentials log verbatim when VERBOSE_DEBUG activates during ZENG multiplayer sessions.
Coordinate a disclosure date — we target 90 days from first contact.
We will credit the ZEsarUX maintainer in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.

3.2 KiB Raw Blame History