Username Enumeration

The Developer portal forgot password functionality that allowed an attacker to determine if a given username was valid. Specifically, when accessing the signup and reset password pages, the application’s response differed depending on if a valid or unknown username was provided.

usecase 1:
When correct username was provided , got a successful response and asked to follow the instructions

usecase 2:
When incorrect username was provided , no message was displayed , only page was refreeshed. end user do not have an idea where input in invalid or any other error.

Affected Scope :
https://prodprhtzinterop.developer.healthtranzformdev.com/reset-password

Impact : 
An attacker can generate a list of probable usernames and easily determine which are valid. The valid usernames can then be used in subsequent attacks, such as password brute force.

Recommendations : 
Update the APIM dev portal forgotpassword function to display generic error messages for both valid and invalid usernames. 

[madhancock]

Hi Mike,

This came from a third-party pen test we had executed on a solution that uses APIM and the dev portal. The objection noted is one can use this is to determine if the user account exists. The recommended solution by the vendor is to have an error message that is more generic not giving the user feedback on if the account exists or not. In theory, the current message gives a potential hacker information on the existence of the account.

I would be happy to discuss this more, please reach out to me as needed ([e-mail])

Thanks,

Elliot

Pen testers often report this but the fix isn’t as simple as making the message more generic. Attackers can use response times or backend HTTP codes to determine if a user exists or not.

Solving these still don’t actually solve the root issue if your application has any form of signup form. Instead they make your application less user friendly, but an attacker can easily test if an account exists by using your signup form - any error on email address is likely to indicate that the account exists, regardless of the message.

The correct solution would be to use anti-automation techniques such as Captcha and WAF.

Both of these are implemented in API Management already and would merit only an “info” level mention on a application security test. Only if a tester can demonstrate that the implemented mitigations are ineffective at preventing effective enumeration would it be of concern.

[azaslonov]

Looks like we’ve come to an agreement. Hence, closing it.