From c41476af0dc50fc1e35c2dc1ddc66bc87dfff70a Mon Sep 17 00:00:00 2001 From: Jiho Kim Date: Fri, 28 Aug 2026 11:12:21 +0200 Subject: [PATCH] fix(xmpp): Enforce mandatory TLS during in-band registration Profanitys in-band account registration path can continue over a raw, unsecured XMPP stream even when the caller selects a mandatory TLS policy. A peer that advertises `jabber:iq:register` but omits `starttls` could cause the registration feature handler to send a registration IQ before TLS is negotiated, exposing user credentials in cleartext. This vulnerability exists because `_register_handle_features` only attempted STARTTLS if the incoming features stanza explicitly included a `` child. If that child was absent, the handler immediately checked for registration support and sent the initial registration IQ without verifying whether TLS was mandatory. Reported-by: Jiho Kim Reported-by: Team Atlanta Signed-off-by: Michael Vetter --- src/xmpp/connection.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/xmpp/connection.c b/src/xmpp/connection.c index 882defc29..3acaf6375 100644 --- a/src/xmpp/connection.c +++ b/src/xmpp/connection.c @@ -417,6 +417,14 @@ _register_handle_features(xmpp_conn_t* xmpp_conn, xmpp_stanza_t* stanza, void* u return 0; } + if ((xmpp_conn_get_flags(xmpp_conn) & XMPP_CONN_FLAG_MANDATORY_TLS) + && !xmpp_conn_is_secured(xmpp_conn)) { + log_debug("Server does not advertise STARTTLS but TLS is mandatory."); + cons_show_error("Server does not advertise STARTTLS, aborting registration."); + xmpp_disconnect(xmpp_conn); + return 0; + } + /* check whether server supports in-band registration */ child = xmpp_stanza_get_child_by_name(stanza, "register"); if (!child) {