Executive Summary

This vulnerability exists in Halloy, an IRC application written in Rust. In versions on *nix and macOS prior to a specific commit, Halloy creates its configuration directory and files using default umask permissions. These default permissions typically result in files having 0644 and directories having 0755 permissions. Because of this, any local user on the system can read plaintext credentials stored in the config.toml file or in referenced password_file paths.

The issue was fixed in commit f180e41061db393acf65bc99f5c5e7397586d9cb, which patches the problem by presumably changing how permissions are set.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing any local user on the system to read sensitive plaintext credentials stored by the Halloy IRC application. This could lead to unauthorized access to your IRC accounts or other services that use these credentials, potentially compromising your privacy and security.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking the permissions of the Halloy IRC application's configuration files and directories on your system. Specifically, you should verify if the config directory and files such as config.toml or any referenced password_file paths have overly permissive permissions (e.g., files with 0644 and directories with 0755), which allow other local users to read plaintext credentials.

You can use commands like the following to check permissions:

• ls -l ~/.config/halloy/config.toml
• ls -ld ~/.config/halloy

If these files or directories have permissions that allow read access to other users, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should update the Halloy IRC application to a version that includes the patch from commit f180e41061db393acf65bc99f5c5e7397586d9cb or later.

Additionally, you can manually restrict the permissions of the configuration directory and files to prevent other local users from reading sensitive information. For example, set the config directory permissions to 0700 and config files to 0600 using commands like:

• chmod 700 ~/.config/halloy
• chmod 600 ~/.config/halloy/config.toml

These steps will help protect plaintext credentials stored in the configuration files from unauthorized local access.

Useful 0 Not Useful 0