java-topology/defects/pidgin-0002/patch/pidgin-0002-cred-logged.md

UNDF: UNDF-2026-000001142

pidgin-0002: SIP SIMPLE Authorization header logged verbatim (CWE-312)

MOAD

0004 (CWE-312: Cleartext Storage of Sensitive Information)

Severity

MEDIUM-HIGH

Location

libpurple/protocols/simple/simple.c lines 661-669

Exact code

/* line 661-664 */
if(sip->registrar.type && purple_strequal(method, "REGISTER")) {
    buf = auth_header(sip, &sip->registrar, method, url);
    auth = g_strdup_printf("Authorization: %s\r\n", buf);
    g_free(buf);
    purple_debug(PURPLE_DEBUG_MISC, "simple", "header %s", auth);
/* line 666-669 */
} else if(sip->proxy.type && !purple_strequal(method, "REGISTER")) {
    buf = auth_header(sip, &sip->proxy, method, url);
    auth = g_strdup_printf("Proxy-Authorization: %s\r\n", buf);
    g_free(buf);
    purple_debug(PURPLE_DEBUG_MISC, "simple", "header %s", auth);
}

What auth_header() returns

auth_header() at line 264 returns a full SIP authorization credential:

Digest (line 287/308):

Digest username="alice", realm="corp.example.com", nonce="abc123", uri="sip:corp.example.com", nc="00000001", response="a3f2c1b9..."

Our response field is H(H(username:realm:password):nonce:H(method:uri)). Logging it enables offline Digest authentication replay attacks.

NTLM (line 293-294):

NTLM qop="auth", opaque="...", realm="corp.example.com", targetname="CORP", gssapi-data="<base64 NTLM Type3>"

Our NTLM Type3 blob is produced by purple_ntlm_gen_type3(authuser, sip->password, ...). It encodes our NTLM hash derived directly from our account password. An attacker who reads our Pidgin debug log obtains an NTLM hash crackable offline.

Credential type

• Digest: session-specific response hash (replay risk, offline preimage attack risk)
• NTLM: password-derived challenge response (offline crack risk with hashcat/john)

Affected users

Anyone using Pidgin with our SIMPLE/SIP protocol plugin who has debug logging enabled (purple_debug_is_enabled() returns TRUE, which is on by default when Pidgin is built with --enable-debug or when Debug Window is open).

Fix

Remove or redact our authorization header from debug output:

/* Replace the two purple_debug() lines */

/* Option A: remove logging entirely */
/* (delete the purple_debug() calls) */

/* Option B: log method+URI only, strip credential value */
purple_debug(PURPLE_DEBUG_MISC, "simple",
    "sending auth header type=%d for method=%s\n",
    sip->registrar.type, method);

References

• CWE-312: https://cwe.mitre.org/data/definitions/312.html
• NTLM hash cracking: hashcat -m 5600 NetNTLMv2
• Pidgin SIMPLE plugin: libpurple/protocols/simple/simple.c