83 lines
4 KiB
Diff
83 lines
4 KiB
Diff
# UNDF: UNDF-2026-000001075
|
|
# UNDF: (leave blank)
|
|
# CWE-312: darktable pwstorage backends log credentials verbatim when -d pwstorage
|
|
#
|
|
# darktable's password storage system (pwstorage) manages service credentials
|
|
# for cloud photo sharing services such as Piwigo. When a user saves their
|
|
# account to Piwigo, _piwigo_set_account() serializes their credentials into:
|
|
#
|
|
# {"server":"example.com","username":"user","password":"s3cr3t"}
|
|
#
|
|
# This JSON value flows into both pwstorage backends:
|
|
#
|
|
# 1. backend_kwallet.c dt_pwstorage_kwallet_set() line 368:
|
|
# dt_print(DT_DEBUG_PWSTORAGE, "...storing (%s, %s)", key, value);
|
|
# `value` is the full JSON blob including the plaintext password.
|
|
#
|
|
# 2. backend_kwallet.c dt_pwstorage_kwallet_get() line 555:
|
|
# dt_print(DT_DEBUG_PWSTORAGE, "...reading (%s, %s)", key, value);
|
|
# Same exposure on read.
|
|
#
|
|
# 3. backend_apple_keychain.c line 65:
|
|
# dt_print(DT_DEBUG_PWSTORAGE, "...storing (%s, %s)", key, value);
|
|
# Same JSON value including password.
|
|
#
|
|
# 4. backend_apple_keychain.c line 239:
|
|
# dt_print(DT_DEBUG_PWSTORAGE, "...reading (%s, %s)", server, json_data);
|
|
# json_data contains the reconstructed JSON with the password.
|
|
#
|
|
# The DT_DEBUG_PWSTORAGE flag is enabled at runtime with `darktable -d pwstorage`
|
|
# or `darktable -d all`. Debug logs go to stdout and optionally to the log file
|
|
# (~/.xsession-errors, journald, or a redirected terminal session). Any debug
|
|
# session — including those run to diagnose KWallet/Keychain connectivity — will
|
|
# expose the user's Piwigo password in plaintext in the terminal output.
|
|
#
|
|
# Lua scripts using darktable.password.save() are also affected: backend_kwallet
|
|
# and backend_apple_keychain receive the raw password string via the same path.
|
|
#
|
|
# Fix: log only the key (service name / username), never the value (which may
|
|
# contain the password). Replace `(%s, %s)` with `(%s, [REDACTED])` in all
|
|
# four dt_print calls.
|
|
#
|
|
# Severity: MEDIUM — requires the debug flag `darktable -d pwstorage` or
|
|
# `-d all` to be active. However, `-d all` is commonly used by users diagnosing
|
|
# OpenCL or other issues, which silently exposes credentials. Piwigo credentials
|
|
# are real username+password (not OAuth tokens), so exposure is direct account
|
|
# compromise.
|
|
#
|
|
--- a/src/common/pwstorage/backend_kwallet.c
|
|
+++ b/src/common/pwstorage/backend_kwallet.c
|
|
@@ -365,7 +365,7 @@ gboolean dt_pwstorage_kwallet_set(const backend_kwallet_context_t *context, con
|
|
|
|
while(g_hash_table_iter_next(&iter, &key, &value))
|
|
{
|
|
- dt_print(DT_DEBUG_PWSTORAGE, "[pwstorage_kwallet_set] storing (%s, %s)", (gchar *)key, (gchar *)value);
|
|
+ dt_print(DT_DEBUG_PWSTORAGE, "[pwstorage_kwallet_set] storing (%s, [REDACTED])", (gchar *)key);
|
|
gsize length;
|
|
gchar *new_key = char2qstring(key, &length);
|
|
|
|
@@ -552,7 +552,7 @@ GHashTable *dt_pwstorage_kwallet_get(const backend_kwallet_context_t *context,
|
|
|
|
dt_print(DT_DEBUG_PWSTORAGE,
|
|
- "[pwstorage_kwallet_get] reading (%s, %s)", (gchar *)key, (gchar *)value);
|
|
+ "[pwstorage_kwallet_get] reading (%s, [REDACTED])", (gchar *)key);
|
|
|
|
g_hash_table_insert(table, key, value);
|
|
}
|
|
--- a/src/common/pwstorage/backend_apple_keychain.c
|
|
+++ b/src/common/pwstorage/backend_apple_keychain.c
|
|
@@ -62,7 +62,7 @@ gboolean pwstorage_apple_keychain_set(const char *slot, GHashTable *table)
|
|
while(g_hash_table_iter_next(&iter, &key, &value))
|
|
{
|
|
- dt_print(DT_DEBUG_PWSTORAGE, "[pwstorage_apple_keychain_set] storing (%s, %s)", (gchar *) key, (gchar *) value);
|
|
+ dt_print(DT_DEBUG_PWSTORAGE, "[pwstorage_apple_keychain_set] storing (%s, [REDACTED])", (gchar *) key);
|
|
|
|
gchar *lbl = g_strconcat("darktable - ", slot, NULL);
|
|
|
|
@@ -236,7 +236,7 @@ GHashTable *pwstorage_apple_keychain_get(const char *slot)
|
|
|
|
dt_print(DT_DEBUG_PWSTORAGE,
|
|
- "[pwstorage_apple_keychain_get] reading (%s, %s)", server, json_data);
|
|
+ "[pwstorage_apple_keychain_get] reading (%s, [REDACTED])", server);
|
|
|
|
g_hash_table_insert(table, g_strdup(server), g_strdup(json_data));
|