Summary
The application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be used to infer the existence of valid user accounts.
Affected Resource
- https:////system/api/getUserData
Impact
An authenticated attacker can use automated tooling to brute force potential usernames and use the application's response to identify valid accounts. This can be used in conjunction with other vulnerabilities, such as the lack of authorization checks, to enumerate and deface another user's sites.
PoC
- Issue a request to an API endpoint for an invalid user
- Issue a request to an API endpoint for a valid user
Note that the application will always return the user information associated with the JWT used, but a 200 response indicates a valid user.
lfgberg Reporter
Summary
The application returns a 200 response when requesting the data of a valid user and a 404 response when requesting the data of an invalid user. This can be used to infer the existence of valid user accounts.
Affected Resource
Impact
An authenticated attacker can use automated tooling to brute force potential usernames and use the application's response to identify valid accounts. This can be used in conjunction with other vulnerabilities, such as the lack of authorization checks, to enumerate and deface another user's sites.
PoC
Note that the application will always return the user information associated with the JWT used, but a 200 response indicates a valid user.