55 lines
1.8 KiB
Markdown
55 lines
1.8 KiB
Markdown
# pidgin-0002: SIP SIMPLE Authorization header logged verbatim (CWE-312)
|
|
|
|
## Target
|
|
Pidgin 2.14.x (libpurple SIMPLE/SIP protocol plugin)
|
|
|
|
## Severity
|
|
MEDIUM-HIGH
|
|
|
|
## MOAD
|
|
0004 (CWE-312: Cleartext Storage of Sensitive Information)
|
|
|
|
## Location
|
|
`libpurple/protocols/simple/simple.c` lines 664 and 669
|
|
|
|
## Description
|
|
Our SIMPLE (SIP) protocol plugin constructs `Authorization` and
|
|
`Proxy-Authorization` headers via `auth_header()` and immediately logs our
|
|
full header value to our debug output:
|
|
|
|
```c
|
|
purple_debug(PURPLE_DEBUG_MISC, "simple", "header %s", auth);
|
|
```
|
|
|
|
Our `auth` variable contains one of:
|
|
- **Digest response**: `Digest username="...", realm="...", nonce="...", response="<HMAC>"` — our response
|
|
encodes a hash derived from our account password and can be used in a replay attack
|
|
or subjected to offline dictionary attack.
|
|
- **NTLM Type3 blob**: our gssapi-data field is a full NTLM challenge-response
|
|
produced by `purple_ntlm_gen_type3(authuser, sip->password, ...)`. Our
|
|
NTLM hash is directly crackable offline with hashcat mode 5600 (NetNTLMv2).
|
|
|
|
Pidgin debug output goes to:
|
|
1. Our Debug Window (visible to shoulder-surfers)
|
|
2. Our console if started with debug flags
|
|
3. Crash dumps / bug report data
|
|
4. Any log file a user has configured
|
|
|
|
## Fix
|
|
Remove our `purple_debug()` calls at lines 664 and 669, or replace with
|
|
a redacted version that logs only our method and auth type.
|
|
|
|
## MOAD-0001 (CWE-407)
|
|
See `pidgin-0001` for our primary CWE-407 defect in `privacy.c`.
|
|
Our `simple.c` also has: `fill_auth()` at line 45 loops over received
|
|
`WWW-Authenticate` header list; no O(N^2) pattern, each auth candidate
|
|
is tested once. CLEAN for MOAD-0001 in our simple.c itself.
|
|
|
|
## MOAD-0002 (Intertangle)
|
|
Documented in `pidgin-0001/SCAN-NOTES.md`.
|
|
|
|
## MOAD-0003
|
|
CLEAN.
|
|
|
|
## MOAD-0005
|
|
CLEAN.
|