Skip to main content

Email uniqueness not properly verified

Description​

The system allows the plus character in the email registration process. An attacker could abuse this feature to create several accounts pointing to the same email.

Impact​

Create multiple accounts with the same email.

Recommendation​

The system must validate emails in such way that an inbox only can be associated or represent an account.

Threat​

Anonymous attacker from the Internet.

Expected Remediation Time​

⌚ 60 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base​

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: N
  • Integrity: L
  • Availability: N

Temporal​

  • Exploit code madurity: P
  • Remediation level: U
  • Report confidence: C

Result​

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:U/RC:C
  • Score:
    • Base: 4.3
    • Temporal: 4.1
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples​

Compliant code​

Passwords should always be stored in encrypted values and never returned as plain text in a response

const registerUser = async (req, res, next) => {
  const { username, password, email } = req.body
  try {
    //The validation method also checks if the email already exists
    await User.validate({
      username,
      password,
      email,
    }).then(user =>
      res.status(200).json({
        message: "User successfully created",
      })
    )
    return user, password, email
  } catch (err) {
    res.status(401).json({
      message: "Something went wrong: User not created",
      error: error.mesage,
    })
  }
}

Non compliant code​

There is no verification for duplicate emails

const registerUser = async (req, res, next) => {
  const { username, password, email } = req.body
  try {
    //The method does not check if the email is duplicated before creating a new user
    await User.validate({
      username,
      password,
    }).then(user =>
      res.status(200).json({
        message: "User successfully created",
      })
    )
    return user, password, email
  } catch (err) {
    res.status(401).json({
      message: "Something went wrong: User not created",
      error: error.mesage,
    })
  }
}

Requirements​