SECURITY: API PUT /users/self - verify e-mail on update - read the description please

[tiblu]

Overview

When User updates e-mail in the profile, it does not get verified.

PANIC!? I don't think so, but definitely not nice.

What vector does it open up?

1. User A has never used the application, has no account with his e-mail.
2. User B registers with an e-mail belonging to him (B), doing the full verification flow.
3. User B updates his e-mail to e-mail belonging to A, NO verification.
4. User A:
   4.1 Logs in with FB/Google that has the e-mail in the profile, User A sees whatever malicious user B has done in the account. If A changes the password, B is lock out and cannot access it any more.
   4.2 Tries to create an account with e-mail/password and gets an error "e-mail already in use". He is confused and goes for the "Forgot password flow" after which A verifies the ownership of e-mail and gets the account locking malicious user B out.

Credits

• @moll who brought this to our attention

Related code:

• https://github.com/citizenos/citizenos-api/blame/37036b1e1f024d6d9fedb8aa00a010ae08892d39/routes/api/user.js#L16

TODO

• Create a flow to verify every new e-mails ownership

[tiblu]

Credits to @moll for pointing this out.

[ilmartyrk]

Fixed by cc30bd2