Vulnerability Classification: User Enumeration

Steps to Reproduce:
1. Visit https://developers.google.com/identity/toolkit/web/configure-service (identitytoolkit API)
2. Follow instructions to set up a configure a test site using one of the quickstart applications.
3. Add a user to the API using the /setAccountInfo endpoint (https://developers.google.com/identity/toolkit/web/reference/relyingparty/setAccountInfo)
4. Query the API using the /verifyPassword endpoint (https://developers.google.com/identity/toolkit/web/reference/relyingparty/verifyPassword) using:
a. A user that exists
b. A user that doesn't exist
5. Note the different responses from the API:
"INVALID_PASSWORD"
"EMAIL_NOT_FOUND"
Depending on the validity of the user's e-mail address or username, the application will tell you if that e-mail/username is associated with an account.

Attack scenario:
Any unauthenticated user with access to the site can spray the /verifyPassword endpoint of the target application with a list of e-mail addresses in order to enumerate which of those e-mails is associated with a valid account. This can be useful for an attacker looking to target specific users with different types of attacks, not limited to XSS, CSRF, brute force/password spraying and more.

Screenshots:
1. https://drive.google.com/open?id=1AgpuJCh_Jfu2ONmnEKUeUv_MdmZkQPA-
2. https://drive.google.com/open?id=1hhw8E1x41K9UB8Kb1dNUpawfxd2k5J2J

Mitigation:
Instead of responding with two error messages, respond with "USERNAME_OR_PASSWORD_NOT_VALID" in the API for both situations.

Issue 148806678

Links (8)

Issue metadata