Skip to main content

User enumeration

Need​

Prevention of user enumeration

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance
  • Usage of javax.servlet-api for building Java web applications with Servlets

Description​

Non compliant code​

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class UserServlet extends HttpServlet {
    private UserRepository userRepository;

    public UserServlet(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
        String username = request.getParameter("username");
        User user = userRepository.findByUsername(username);
        if (user == null) {
            response.getWriter().write("User not found");
            return;
        }
        response.getWriter().write("User found");
    }
}

The above Java servlet is vulnerable to user enumeration. The vulnerability lies in the doGet method where it processes the HTTP GET request. This method retrieves the "username" parameter from the request and uses it to find the corresponding user in the repository.

The problem arises when the system provides different responses based on whether the user exists or not. If the user does not exist, the system responds with "User not found". If the user exists, the system responds with "User found". This difference in responses allows an attacker to enumerate valid users.

An attacker can exploit this vulnerability by making repeated requests with different usernames. By observing the response, the attacker can determine whether each username is valid or not. This can lead to further attacks such as brute force attacks on the enumerated usernames.

This vulnerability can be mitigated by providing a generic response regardless of whether the user exists or not. This prevents the attacker from being able to determine the validity of a username based on the system's response.

Steps​

  • Implement a consistent response for both existent and non-existent users
  • Avoid providing specific error messages that disclose user existence
  • Ensure that the response time is consistent for both existent and non-existent users
  • Do not expose any information that can be used to enumerate valid users
  • Consider implementing rate limiting or other measures to prevent enumeration through response times or frames count

Compliant code​

import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class UserServlet extends HttpServlet {
    private UserRepository userRepository;

    public UserServlet(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException {
        String username = request.getParameter("username");
        User user = userRepository.findByUsername(username);
        response.getWriter().write("Processing request");
    }
}

The updated code no longer provides different responses for existent and non-existent users. Regardless of whether the user exists or not, the response is now consistently "Processing request". This prevents an attacker from being able to enumerate valid users via error messages.

The specific error message that disclosed the existence of a user has been removed. Previously, the system would respond with "User not found" or "User found", which could be used by an attacker to determine if a username was valid. Now, the system simply responds with "Processing request", which gives no indication of whether the user exists or not.

The response time is now consistent for both existent and non-existent users. Previously, the system might take longer to respond if a user did not exist, as it would have to search through the entire user repository. Now, the system responds immediately after receiving the request, before it even begins searching for the user.

No information is exposed that can be used to enumerate valid users. The system no longer provides any feedback about the existence of a user, so an attacker cannot use this information to enumerate valid users.

Rate limiting or other measures to prevent enumeration through response times or frames count should be considered as part of the overall security strategy. This code does not implement such measures, as they would typically be implemented at a higher level (e.g., at the network or application level). However, by ensuring that the response time and message are consistent for all users, this code helps to mitigate the risk of user enumeration.

References​

Last updated on