Security Fix for Username Enumeration - huntr.dev

[huntr-helper]

https://huntr.dev/users/d3v53c has fixed the Username Enumeration vulnerability 🔨. d3v53c has been awarded $25 for fixing the vulnerability through the huntr bug bounty program 💵. Think you could fix a vulnerability like this?

Get involved at https://huntr.dev/

Q | A
Version Affected | ALL
Bug Fix | YES
Original Pull Request | 418sec#1
Vulnerability README | https://github.com/418sec/huntr/blob/master/bounties/other/traduora/1/README.md

User Comments:

📊 Metadata *

Please enter the direct URL for this bounty on huntr.dev. This is compulsory and will help us process your bounty submission quicker.

Bounty URL: https://www.huntr.dev/bounties/1-other-traduora

⚙️ Description *

User enumeration is when a malicious actor can use brute-force techniques to either guess or confirm valid users in a system. User enumeration is often a web application vulnerability, though it can also be found in any system that requires user authentication.

💻 Technical Description *

Raised Unauthorized exception, whenever a non-existent email tries to authenticate, instead of Not found (404). This would fix the issue, as the Unauthorized exception only is raised when invalid creds are encountered

🐛 Proof of Concept (PoC) *

Permalink 1: https://drive.google.com/file/d/1j3DCG7SteEMv_0CBROHB2nkyM4l2aNyZ/view?usp=sharing
Permalink 2: https://drive.google.com/file/d/11fwC41hkHE9JjedyOWNH42wkVU4THQh3/view?usp=sharing

🔥 Proof of Fix (PoF) *

Response with existent email id, with wrong password:

Response with non-existent email id:

👍 User Acceptance Testing (UAT)

After fix functionality is unaffected.

bin/check.sh

[CLAassistant]

All committers have signed the CLA.

[anthonynsimon]

Thanks for the PR I will review it shortly. I see some failing checks on CI, could you re-run them? Not sure if it's a related change or just an odd issue with the end to end tests.

[JamieSlome]

@anthonynsimon - great, thanks. I will have another look at the unit tests this week. Will also look into whether it could be the end to end tests, cheers! 🍰

[evereq]

@JamieSlome I am going to merge this PR as it makes sense for me to do so to prevent possible hacks.
We are currently checking everything and if some tests will fail because of that PR we will fix them too later, in separate PR.

Btw, I am not familiar with @huntr-helper (https://huntr.dev/), do we need to do there anything so you get that bounty?

Thank you!

[JamieSlome]

@evereq - great, let @d3v53c or myself know if you have any more questions regarding this PR.

With regards to https://huntr.dev, it is a bug bounty platform that crowdsources disclosures in any of the 28M projects on GitHub. We reward our community with bounties if they can find vulnerabilities and subsequently ensure they are patched in the repository.

There is nothing that we need to do here, as once the PR is merged, our automation will kick in and track the necessary information for rewarding bounties.

If you are interested in receiving more disclosures in the future, feel free to put our badge in your README.md:

[![huntr](https://cdn.huntr.dev/huntr_security_badge_mono.svg)](https://huntr.dev)