Possible security leak at CalDav login

[JoergHerzinger]

Hi, I just tried logging into caldav (https://my.group.office.install.com/caldav) and mistyped my password and something strange happened:

−
<d:error>
<s:exception>Exception</s:exception>
<s:message>Falscher Benutzername oder Passwort</s:message>
−
<s:file>
/usr/local/share/groupoffice/modules/imapauth/classes/imapauth.class.inc.php
</s:file>
<s:line>170</s:line>
<s:code>0</s:code>
−
<s:stacktrace>
#0 [internal function]: imapauth::before_login('username@domain...', '<MY_CLEARTEXT_PASSWORD_HERE>', false)
#1 /usr/local/share/groupoffice/classes/base/events.class.inc.php(109): call_user_func_array(Array, Array)
#2 /usr/local/share/groupoffice/classes/base/auth.class.inc.php(183): GO_EVENTS->fire_event('before_login', Array)
#3 /usr/local/share/groupoffice/modules/dav/DAV/Auth_Backend.class.inc.php(69): GO_AUTH->login('username@domain...', '<MY_CLEARTEXT_PASSWORD_HERE>', 'normal', false)
#4 /usr/local/share/groupoffice/modules/dav/SabreDAV/lib/Sabre/DAV/Auth/Plugin.php(107): GO_DAV_Auth_Backend->authenticate(Object(GO_CalDAV_Server), 'Group-Office Ca...')
#5 [internal function]: Sabre_DAV_Auth_Plugin->beforeMethod('GET', '')
#6 /usr/local/share/groupoffice/modules/dav/SabreDAV/lib/Sabre/DAV/Server.php(409): call_user_func_array(Array, Array)
#7 /usr/local/share/groupoffice/modules/dav/SabreDAV/lib/Sabre/DAV/Server.php(431): Sabre_DAV_Server->broadcastEvent('beforeMethod', Array)
#8 /usr/local/share/groupoffice/modules/dav/SabreDAV/lib/Sabre/DAV/Server.php(201): Sabre_DAV_Server->invokeMethod('GET', '')
#9 /usr/local/share/groupoffice/modules/caldav/calendar.php(52): Sabre_DAV_Server->exec()
#10 {main}
</s:stacktrace>
<s:sabredav-version>1.4.3</s:sabredav-version>
</d:error>

This happens every time I try to login with a wrong password and as you can see it holds the password I typed in cleartext.

[WilmarVB]

Hello Joerg,

I suppose what you see in the trace are the (false) username and (false) password you just entered?

[JoergHerzinger]

Yes, of course, but still these usernames and passwords are really really close to the correct ones, so they should not ever be visible, logged or anything.

[Intermesh]

don't print stack traces on production servers. We can't hide those passwords because they are required for those functions. In general you should disable display_errors in php.ini but even better is to set everything to production values.