Fix user enumeration attack vulnerability in /auth/forgotpw

ubccr / mokey

FreeIPA self-service account management portal

BSD 3-Clause "New" or "Revised" License

190 stars 44 forks source link

Fix user enumeration attack vulnerability in /auth/forgotpw #92

Open xx4h opened 3 years ago

xx4h commented 3 years ago

Currently it is possible to find valid user accounts by bruteforcing /auth/forgotpw.

I understand the convenience of being always told what the problem is (from the user perspective), but at least some of use (or mabye even the most of us) use mokey to provide a self-service portal to an unsecure network or even expose it to the internet, which is why we should at least make this configurable.

Would be happy to get some more thoughts and opinions on this.

Cheers - xx4h

aebruno commented 3 years ago

Agreed. This should probably always return success (from the user perspective) and just do nothing on the backend if and invalid user account was provided. Having this configurable would be nice. We do have some rudimentary rate limiting in mokey as well which makes brute forcing forgotpw slightly more challenging. If enabled, by default it only allows 15 POST requests per hour.