OPAC password recovery allows to find out which email address belongs to an account. An attacker could systematically guess login names. If they hit an existing one, OPAC displays a message like: An email has been sent to "xxx@yyy.zz". Having a combination of login name and email, attackers could use the information e.g. for phishing or other personalized actions. To reproduce: - Enable OPAC password recovery (syspref OpacResetPassword) - 'Guess' a login name e.g. by using a common pattern like ptester for Peter Tester - If such account exists, you get to know the related email address Solution: - Do not display the email addres. Change the message to something like "An email has been sent to the email address related with the account." (Related to Bug 18570 because that would need a message change as well).
Created attachment 63642 [details] [review] Bug 18653: Possible privacy breach with OPAC password recovery OPAC password recovery allows to find out which email address belongs to an account. An attacker could systematically guess login names. If they hit an existing one, OPAC displays a message like: An email has been sent to "xxx@yyy.zz". Having a combination of login name and email, attackers could use the information e.g. for phishing or other personalized actions. To reproduce: - Enable OPAC password recovery (syspref OpacResetPassword) - 'Guess' a login name e.g. by using a common pattern like ptester for Peter Tester - If such account exists, you get to know the related email address This patch removes the email address from the success message. Additionaly, it changes wording to address Bug 18570 ('will be sent' instead of 'has been sent')
Created attachment 63657 [details] [review] Bug 18653: Possible privacy breach with OPAC password recovery OPAC password recovery allows to find out which email address belongs to an account. An attacker could systematically guess login names. If they hit an existing one, OPAC displays a message like: An email has been sent to "xxx@yyy.zz". Having a combination of login name and email, attackers could use the information e.g. for phishing or other personalized actions. To reproduce: - Enable OPAC password recovery (syspref OpacResetPassword) - 'Guess' a login name e.g. by using a common pattern like ptester for Peter Tester - If such account exists, you get to know the related email address This patch removes the email address from the success message. Additionaly, it changes wording to address Bug 18570 ('will be sent' instead of 'has been sent') Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl> Simplified the wording. "Will be sent shortly" is used elsewhere too.
Marc, do you agree with the changed wording ?
(In reply to Marcel de Rooy from comment #3) > Marc, do you agree with the changed wording ? Yes, sure.
What about display partially the email address?
(In reply to Jonathan Druart from comment #5) > What about display partially the email address? No, we should give no public information about the email address at all.
Not sure, can I add related bugs or bugs where that one depends on? Or will that expose the bug? (For example Bug 18616 and Bug 8753)
(In reply to Marc Véron from comment #7) > Not sure, can I add related bugs or bugs where that one depends on? Or will > that expose the bug? (For example Bug 18616 and Bug 8753) You can, the info of the bug will be kept hidden.
IMO this bug gets some more importance with Bug 18616 - The "Add forgot password link to OPAC" should allow patrons to use their library card number in addition to username.
Taking the liberty to promote this trivial security patch to PQA.
Pushed to master for 17.11, thanks to everybody involved!
Pushed to 17.05.x, will be in 17.05.01
This patch has been pushed to 16.11.x and will be in 16.11.09.
Pushed to 16.05.x, for 16.05.15 release