Bug 18653 - Possible privacy breach with OPAC password recovery
Summary: Possible privacy breach with OPAC password recovery
Status: Pushed to Stable
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Marc Véron
QA Contact: Marcel de Rooy
URL:
Whiteboard:
Keywords:
Depends on: 8753
Blocks: 18956
  Show dependency treegraph
 
Reported: 2017-05-23 05:00 UTC by Marc Véron
Modified: 2017-11-28 15:10 UTC (History)
7 users (show)

See Also:
Change sponsored?: ---
Patch complexity: String patch
Bot Control: ---
When did the bot last check this:
Who signed the patch off:
Text to go in the release notes:


Attachments
Bug 18653: Possible privacy breach with OPAC password recovery (1.93 KB, patch)
2017-05-23 05:14 UTC, Marc Véron
Details | Diff | Splinter Review
Bug 18653: Possible privacy breach with OPAC password recovery (2.07 KB, patch)
2017-05-23 15:01 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Marc Véron 2017-05-23 05:00:44 UTC
OPAC password recovery allows to find out which email address belongs to an account. An attacker could systematically guess login names. If they hit an existing one, OPAC displays a message like:
An email has been sent to "xxx@yyy.zz".

Having a combination of login name and email, attackers could use the information e.g. for phishing or other personalized actions.

To reproduce:
- Enable OPAC password recovery (syspref OpacResetPassword)
- 'Guess' a login name e.g. by using a common pattern like ptester for Peter Tester
- If such account exists, you get to know the related email address

Solution:
- Do not display the email addres. Change the message to something like
"An email has been sent to the email address related with the account."

(Related to Bug 18570 because that would need a message change as well).
Comment 1 Marc Véron 2017-05-23 05:14:22 UTC
Created attachment 63642 [details] [review]
Bug 18653: Possible privacy breach with OPAC password recovery

OPAC password recovery allows to find out which email address belongs to an account. An attacker could systematically guess login names. If they hit an existing one, OPAC displays a message like:
An email has been sent to "xxx@yyy.zz".

Having a combination of login name and email, attackers could use the information e.g. for phishing or other personalized actions.

To reproduce:
- Enable OPAC password recovery (syspref OpacResetPassword)
- 'Guess' a login name e.g. by using a common pattern like ptester for Peter Tester
- If such account exists, you get to know the related email address

This patch removes the email address from the success message. Additionaly, it changes
wording to address Bug 18570 ('will be sent' instead of 'has been sent')
Comment 2 Marcel de Rooy 2017-05-23 15:01:47 UTC
Created attachment 63657 [details] [review]
Bug 18653: Possible privacy breach with OPAC password recovery

OPAC password recovery allows to find out which email address belongs to an account. An attacker could systematically guess login names. If they hit an existing one, OPAC displays a message like:
An email has been sent to "xxx@yyy.zz".

Having a combination of login name and email, attackers could use the information e.g. for phishing or other personalized actions.

To reproduce:
- Enable OPAC password recovery (syspref OpacResetPassword)
- 'Guess' a login name e.g. by using a common pattern like ptester for Peter Tester
- If such account exists, you get to know the related email address

This patch removes the email address from the success message. Additionaly, it changes
wording to address Bug 18570 ('will be sent' instead of 'has been sent')

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Simplified the wording. "Will be sent shortly" is used elsewhere too.
Comment 3 Marcel de Rooy 2017-05-23 15:02:49 UTC
Marc, do you agree with the changed wording ?
Comment 4 Marc Véron 2017-05-23 15:26:41 UTC
(In reply to Marcel de Rooy from comment #3)
> Marc, do you agree with the changed wording ?

Yes, sure.
Comment 5 Jonathan Druart 2017-05-23 16:10:34 UTC
What about display partially the email address?
Comment 6 Marc Véron 2017-05-24 07:35:35 UTC
(In reply to Jonathan Druart from comment #5)
> What about display partially the email address?

No, we should give no public information about the email address at all.
Comment 7 Marc Véron 2017-05-30 19:29:26 UTC
Not sure, can I add related bugs or bugs where that one depends on? Or will that expose the bug? (For example Bug 18616 and Bug 8753)
Comment 8 Jonathan Druart 2017-05-30 20:42:45 UTC
(In reply to Marc Véron from comment #7)
> Not sure, can I add related bugs or bugs where that one depends on? Or will
> that expose the bug? (For example Bug 18616 and Bug 8753)

You can, the info of the bug will be kept hidden.
Comment 9 Marc Véron 2017-05-31 05:45:58 UTC
IMO this bug gets some more importance with Bug 18616 - The "Add forgot password link to OPAC" should allow patrons to use their library card number in addition to username.
Comment 10 Marcel de Rooy 2017-06-02 08:42:41 UTC
Taking the liberty to promote this trivial security patch to PQA.
Comment 11 Jonathan Druart 2017-06-05 15:59:07 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 12 Fridolin SOMERS 2017-06-09 14:41:14 UTC
Pushed to 17.05.x, will be in 17.05.01
Comment 13 Katrin Fischer 2017-06-11 22:54:24 UTC
This patch has been pushed to 16.11.x and will be in 16.11.09.
Comment 14 Mason James 2017-07-31 11:17:04 UTC
Pushed to 16.05.x, for 16.05.15 release