Multiple user creation with the same email Id via existing verification bypass in heroiclabs/nakama
Valid
Reported on
Jun 14th 2022
- Hello team, while i was checking on the nakama dashboard as an
Administrator
i noticed that we can bypass the existing verification and create multiple user with same email id
Steps to reproduce:
- Open the dashboard as an
admin
user and go to the user management formhttp://site.com/#/users
- Create a user and capture the request with burpsuite and send that request to repeater
- when we try to create a user with existing email id, the server will throw error like:
{"code":9,"message":"Username or Email already exists","details":[]}
- So we can bypass this validation and create new user with same email id by adding space in the
email
parameter like:
{"username":"user1","email":"test@test.com","password":"Password@123","role":3,"newsletter_subscription":false}
- In this case we have created
user1
withemail id
test@test.com
and we are able to createuser2
with thesame email id
by adding space in theemail
parameter like this👇:
{"username":"user2","email":" test@test.com","password":"Password@123","role":3,"newsletter_subscription":false}
- For another user with the same
EmailID
need to add an extra space like this, for each time add extra spaces:
Impact
- Due to this existing security mechanism bypass the owner can create multiple users via the same email id, and it can lead to business logic risk
- If an attacker has access to the admin user then the attacker can create users with the same email id
We are processing your report and will contact the
heroiclabs/nakama
team within 24 hours.
a year ago
drxadz modified the report
a year ago
We have contacted a member of the
heroiclabs/nakama
team and are waiting to hear back
a year ago
The researcher's credibility has increased: +7
The fix bounty has been dropped
This vulnerability will not receive a CVE
@admin @maintainer can we go for a CVE? what's your opinion??
@drxadz - it is up to the maintainer if they want to assign and publish a CVE for this report. Seeing as they did not request a CVE (which they can do through the UI), I assume they do not want one for this report.
to join this conversation