Skip to content

Fix user enumeration in guest registration endpoint (CVE-2025-59716) #661

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
thesmartshadow wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Fix user enumeration in guest registration endpoint (CVE-2025-59716) #661

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
633157b
Fix guest registration user enumeration (CVE-2025-59716)
thesmartshadow Jan 22, 2026
5bbcfff
Merge branch 'master' into fix-cve-2025-59716
thesmartshadow Feb 1, 2026
8bd4dc5
Fix: add missing newline at end of file
thesmartshadow Feb 2, 2026
a6a32b8
Merge branch 'master' into fix-cve-2025-59716
thesmartshadow Feb 2, 2026
42a8b3d
CI: rerun
thesmartshadow Feb 2, 2026
6c8b53b
Merge branch 'master' into fix-cve-2025-59716
thesmartshadow Feb 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 52 additions & 31 deletions lib/Controller/RegisterController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,43 +118,58 @@ public function __construct(
*/
public function showPasswordForm($email, $token) {
$errorMessages = [];
$userId = \strtolower($email);
$parameters = [];

$parameters['email'] = (string)$email;
$parameters['token'] = (string)$token;
$parameters['postAction'] =
$this->urlGenerator->linkToRouteAbsolute('guests.register.register');

// Keep the mail format validation (non-sensitive), but avoid account enumeration.
if (empty($email) || !$this->mailer->validateMailAddress($email)) {
$errorMessages['email'] = (string)$this->l10n->t(
'Invalid mail address'
$errorMessages['email'] = (string)$this->l10n->t('Invalid mail address');

$parameters['messages'] = $errorMessages;
return new TemplateResponse(
$this->appName,
'form.password',
$parameters,
'guest'
);
}

$userId = \strtolower($email);

// Fetch both values with safe defaults to avoid revealing existence via distinct errors.
$isGuest = (bool)$this->config->getUserValue(
$userId,
'owncloud',
'isGuest'
'isGuest',
0
);

if (!$isGuest) {
$errorMessages['username'] = (string)$this->l10n->t(
'No such guest user'
);
}

$checkToken = $this->config->getUserValue(
$registerToken = (string)$this->config->getUserValue(
$userId,
'guests',
'registerToken'
'registerToken',
''
);

if (empty($checkToken)) {
$errorMessages['token'] = (string)$this->l10n->t(
'The token is invalid'
);
// Only allow showing the password form when BOTH:
// - user is a guest
// - provided token matches stored token (constant-time comparison)
$valid = false;
if ($isGuest && $registerToken !== '' && (string)$token !== '') {
$valid = \hash_equals($registerToken, (string)$token);
}

// If invalid for ANY reason (non-guest, missing token, mismatch), show a generic error.
// This prevents user enumeration via observable response differences.
if (!$valid) {
$errorMessages['token'] = (string)$this->l10n->t('The token is invalid');
}

$parameters['email'] = $email;
$parameters['messages'] = $errorMessages;
$parameters['token'] = $token;
$parameters['postAction'] =
$this->urlGenerator->linkToRouteAbsolute('guests.register.register');

return new TemplateResponse(
$this->appName,
Expand Down Expand Up @@ -192,22 +207,28 @@ public function register() {
);
}

$registerToken = $this->config->getUserValue(
$registerToken = (string)$this->config->getUserValue(
$userId,
'guests',
'registerToken',
false
''
);

// only show token error when there are no others
if (
empty($parameters['messages']) &&
(empty($token) || empty($registerToken) || $registerToken !== $token)
) {
$parameters['token'] = $token;
$parameters['email'] = $email;
$parameters['messages']['token'] = (string)$this->l10n->t(
'The token is invalid'
);
// Use constant-time compare for robustness.
if (empty($parameters['messages'])) {
$valid = false;
if ($token !== '' && $registerToken !== '') {
$valid = \hash_equals($registerToken, $token);
}

if (!$valid) {
$parameters['token'] = $token;
$parameters['email'] = $email;
$parameters['messages']['token'] = (string)$this->l10n->t(
'The token is invalid'
);
}
}

if (!empty($parameters['messages'])) {
Expand Down