49 lines
1.7 KiB
Markdown
49 lines
1.7 KiB
Markdown
# pidgin-0002 — CWE-312 SIP SIMPLE Authorization header logged verbatim
|
|
|
|
**MOAD:** 0004 (CWE-312: Cleartext Storage of Sensitive Information)
|
|
**Severity:** MEDIUM-HIGH
|
|
**UNDF:** UNDF-2026-000001142
|
|
|
|
## Location
|
|
|
|
`libpurple/protocols/simple/simple.c` lines 661-669
|
|
|
|
## Pattern
|
|
|
|
Our SIMPLE (SIP) protocol plugin constructs Authorization and Proxy-Authorization
|
|
headers via `auth_header()` and immediately logs our full header value:
|
|
|
|
```c
|
|
buf = auth_header(sip, &sip->registrar, method, url);
|
|
auth = g_strdup_printf("Authorization: %s\r\n", buf);
|
|
g_free(buf);
|
|
purple_debug(PURPLE_DEBUG_MISC, "simple", "header %s", auth);
|
|
```
|
|
|
|
Our `auth` variable contains either:
|
|
- **Digest response**: `Digest username="...", realm="...", nonce="...", response="<hash>"`
|
|
Our response hash is crackable offline or usable in replay attacks.
|
|
- **NTLM Type3 blob**: produced by `purple_ntlm_gen_type3(authuser, sip->password, ...)`
|
|
Our NTLM hash is crackable offline with hashcat mode 5600 (NetNTLMv2).
|
|
|
|
Pidgin debug output goes to our Debug Window, console (when started with debug
|
|
flags), crash dumps, and any log file our user has configured.
|
|
|
|
## Fix
|
|
|
|
Remove our `purple_debug()` calls at lines 664 and 669, or replace with a
|
|
redacted version that logs only our auth method and type:
|
|
|
|
```c
|
|
purple_debug(PURPLE_DEBUG_MISC, "simple",
|
|
"sending auth header type=%d for method=%s\n",
|
|
sip->registrar.type, method);
|
|
```
|
|
|
|
## Impact
|
|
|
|
Any Pidgin user running with debug mode enabled (on by default in debug builds
|
|
and when our Debug Window is open) exposes their SIP credentials to:
|
|
1. Shoulder-surfing via our on-screen Debug Window
|
|
2. Offline NTLM crack if our debug log is read by an attacker
|
|
3. Inclusion in crash reports / bug reports submitted to third parties
|