java-topology/defects/pidgin-0002/TICKET.md

pidgin-0002 — CWE-312 SIP SIMPLE Authorization header logged verbatim

MOAD: 0004 (CWE-312: Cleartext Storage of Sensitive Information) Severity: MEDIUM-HIGH UNDF: UNDF-2026-000001142

Location

libpurple/protocols/simple/simple.c lines 661-669

Pattern

Our SIMPLE (SIP) protocol plugin constructs Authorization and Proxy-Authorization headers via auth_header() and immediately logs our full header value:

buf = auth_header(sip, &sip->registrar, method, url);
auth = g_strdup_printf("Authorization: %s\r\n", buf);
g_free(buf);
purple_debug(PURPLE_DEBUG_MISC, "simple", "header %s", auth);

Our auth variable contains either:

• Digest response: Digest username="...", realm="...", nonce="...", response="<hash>" Our response hash is crackable offline or usable in replay attacks.
• NTLM Type3 blob: produced by purple_ntlm_gen_type3(authuser, sip->password, ...) Our NTLM hash is crackable offline with hashcat mode 5600 (NetNTLMv2).

Pidgin debug output goes to our Debug Window, console (when started with debug flags), crash dumps, and any log file our user has configured.

Fix

Remove our purple_debug() calls at lines 664 and 669, or replace with a redacted version that logs only our auth method and type:

purple_debug(PURPLE_DEBUG_MISC, "simple",
    "sending auth header type=%d for method=%s\n",
    sip->registrar.type, method);

Impact

Any Pidgin user running with debug mode enabled (on by default in debug builds and when our Debug Window is open) exposes their SIP credentials to:

1. Shoulder-surfing via our on-screen Debug Window
2. Offline NTLM crack if our debug log is read by an attacker
3. Inclusion in crash reports / bug reports submitted to third parties