Skip to main content

Business information leak - Customers or providers

Description

Sensitive information such as customer or providers lists, emails, phone numbers or identifiers can be obtained from the application.

Impact

Obtain sensitive information to craft new attack vectors.

Recommendation

Implement security controls to ensure that the leaked information can be accessed only by authenticated and authorized users.

Threat

Authenticated attacker from the Internet.

Expected Remediation Time

⌚ 30 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: L
  • Attack complexity: H
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: H
  • Integrity: N
  • Availability: N

Temporal

  • Exploit code madurity: X
  • Remediation level: O
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:X/RL:O/RC:X
  • Score:
    • Base: 4.7
    • Temporal: 4.5
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

Passwords should always be stored in encrypted values and never returned as plain text in a response

const registerUser = async (req, res, next) => {
const { username, HashPassword } = req.body
try {
await User.create({
username,
HashPassword,
}).then(user =>
res.status(200).json({
message: "User successfully created",
user,
})
)
} catch (err) {
res.status(401).json({
message: "Something went wrong. User not created",
error: error.mesage,
})
}
}

Non compliant code

Some sensitive information (Password) in returned in plain text values

const registerUser = async (req, res, next) => {
const { username, password } = req.body
try {
await User.create({
username,
password,
}).then(user =>
res.status(200).json({
message: "User successfully created",
user,
password,
})
)
return user, password
} catch (err) {
res.status(401).json({
message: "Something went wrong: User not created",
error: error.mesage,
})
}
}

Requirements