Skip to main content

Automatic information enumeration - Corporate information

Description

It is possible to automatically enumerate system information such as finding IDs due to different messages for existing and non existing finding IDs.

Impact

Get all existing findings in the system.

Recommendation

Show the same response for existing and non-existing findings.

Threat

External attacker with access to integrates.

Expected Remediation Time

⌚ 60 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal

  • Exploit code madurity: X
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:X/RL:X/RC:X
  • Score:
    • Base: 4.3
    • Temporal: 4.3
  • Severity:
    • Base: Medium
    • Temporal: Medium

Code Examples

Compliant code

The application sends the same response regardless of the finding status

const getFindings = (req, res) => {
if (isValidUser(req.body.user)) {
//Code to handle finding search that does not diferentiate response between existing and unexisting findings
}
}

Non compliant code

The application sets different response messages that differ based on the finding status

const getFindings = (req, res) => {
if (isValidUser(req.body.user) && isExistingFinding(req.body.findingId)) {
res.message("the finding Id exists in our database");
redirect('users/findingId');
}else if (isValidUser){
res.message("The finding ID does not exist");
}
}

Requirements