Summary

The API endpoint http://<Server-IP>/v1/users/login in ZimaOS returns distinct responses based on whether a username exists or the password is incorrect. This behavior can be exploited for username enumeration, allowing attackers to determine whether a user exists in the system or not. Attackers can leverage this information in further attacks, such as credential stuffing or targeted password brute-forcing.

Details

The vulnerability arises due to differing error messages returned by the API when invalid usernames and incorrect passwords are provided. Attackers can use this discrepancy to enumerate valid usernames by comparing the responses for existing and non-existing usernames.

PoC

1. Send a POST request to the login endpoint with a valid username but an incorrect password:

POST http://<Server-IP>/v1/users/login
Request:
{
  "username": "validuser",
  "password": "wrongpassword"
}

Response:

{
  "Success": 10013,
  "message": "User does not exist or password is invalid"
}

2. Send another POST request with a non-existent username:

Request:
{
  "username": "invaliduser",
  "password": "somepassword"
}

Response:

{
  "Success": 10006,
  "message": "User does not exist"
}

The differing error messages allow an attacker to determine whether a username exists in the system by comparing the two responses.

YouTube Video PoC

Unlisted YouTube PoC Link

Impact

1. User Enumeration: Attackers can collect valid usernames for use in future attacks, such as password brute-forcing or credential stuffing.
2. Targeted Attacks: With knowledge of valid usernames, attackers can focus their efforts on known users, increasing the success rate of other attacks, including phishing or account takeover.

Recommendation

1. Generic Error Message: Return a generic error message for both incorrect usernames and passwords, such as "Invalid username or password," regardless of the actual error.

Possible Fix Code:

Before:

if user_does_not_exist:
    return {
        "Success": 10006,
        "message": "User does not exist"
    }
elif password_incorrect:
    return {
        "Success": 10013,
        "message": "User does not exist or password is invalid"
    }

After:

if user_does_not_exist or password_incorrect:
    return {
        "Success": 10013,
        "message": "Invalid username or password"
    }

Logging and Monitoring

Log failed login attempts and generate alerts for suspicious activity, such as a high volume of failed logins.