Listen to this Post
This vulnerability exploits the insecure feedback provided during the password reset functionality. When an unauthenticated user submits an email address for a password reset, the application checks its database for a corresponding user account. If the email is found, the backend logic proceeds to generate and send a reset token, often returning an HTTP 200 status with a message like “Password reset link sent.” If the email is not registered, the application logic takes a different path, typically throwing an exception or error that results in a different HTTP response, such as a 404 status or a “User not found” message embedded in the response body. By programmatically submitting requests and analyzing these differences—be it HTTP status codes, response times, or the text content of error pages—an attacker can map which emails are valid registered users. This information leakage occurs before any state-changing action (like actually sending an email) is securely validated, making it a classic side-channel information disclosure flaw.
Platform: CI4MS
Version: Affected versions
Vulnerability: Email enumeration
Severity: Medium
date: 2024-10-09
Prediction: 2024-11-20
What Undercode Say:
Analytics:
`curl -X POST https://target/forgot-password -d “[email protected]”`
`diff <(curl -s -o /dev/null -w "%{http_code}" target/[email protected]) <(curl -s -o /dev/null -w "%{http_code}" target/[email protected])`
`for email in $(cat wordlist.txt); do curl -s target/forgot-password --data "email=$email" | grep -q "sent" && echo "Valid: $email"; done`
How Exploit:
Send reset request for unknown email. Observe “User not found” error. Send request for known/test email. Observe “Reset link sent” success. Automate with list to enumerate all valid emails.
Protection from this CVE:
Use uniform responses. Always return HTTP 200. Generic success message. Implement rate-limiting.
Impact:
User privacy compromised. Enables targeted phishing. Facilitates account brute-force.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
