Document possible email address enumeration in PasswordResetView.

[Mohammad Almazroa]

Hello :)

Description:
While implementing the password reset functionality using:

from django.contrib.auth.views import PasswordResetView, PasswordResetDoneView, PasswordResetConfirmView, PasswordResetCompleteView

It was noticed that an attacker will be able to enumerate registered users emails by the response time of the application. long response time means the email exists, quick response time means it does not exist.

Impact:
This will allow attacker to collect list of users emails, which can help in further attacks. Knowing list of emails can start "Password spraying" attack.

Remediation:

Set up a random sleep time when the email does not exists. The response time of correct and incorrect email should be the same.

Screenshot:

Notice that the email "mmalmazroa@…" is an email that is assigned to a user registered in the application, and the response time in "Response received" tab.

Thank you for your work <3

[Mariusz Felisiak]

First of all, please note that security issues ​should be privately sent to security@… and never on public issue trackers.

Your analysis is correct, however PasswordResetView sends an email which always take an extra time. We don't know how much it takes so adding a fixed delay is impossible and for a random sleep time you'd just need a bit of statistic to figure it out.

I think we could document this potential account existence leak in ​PasswordResetView.

[Mariusz Felisiak]

​PR

[Florian Apolloner]

Replying to Mohammad Almazroa:

Remediation:

Set up a random sleep time when the email does not exists. The response time of correct and incorrect email should be the same.

This is not a remediation, you can average that out with a few requests…

[Mohammad Almazroa]

Replying to Florian Apolloner:

Replying to Mohammad Almazroa:

Remediation:

Set up a random sleep time when the email does not exists. The response time of correct and incorrect email should be the same.

This is not a remediation, you can average that out with a few requests…

A random sleep time should be within the range that the "PasswordResetView" is taking to send an email. This way it is not clear what response time that means valid or not valid email.
That is just an idea, if you have something better I think we should do it.

[Mohammad Almazroa]

Replying to felixxm:

First of all, please note that security issues ​should be privately sent to security@… and never on public issue trackers.

Your analysis is correct, however PasswordResetView sends an email which always take an extra time. We don't know how much it takes so adding a fixed delay is impossible and for a random sleep time you'd just need a bit of statistic to figure it out.

I think we could document this potential account existence leak in ​PasswordResetView.

Really sorry that I reported it publicly here.

[Florian Apolloner]

Replying to Mohammad Almazroa:

A random sleep time should be within the range that the "PasswordResetView" is taking to send an email. This way it is not clear what response time that means valid or not valid email.

But you don't know how long sending emails takes, so it will just be a relatively good guess at best which does not help since it can be determined via enough requests…

[Mohammad Almazroa]

Replying to Florian Apolloner:

Replying to Mohammad Almazroa:

A random sleep time should be within the range that the "PasswordResetView" is taking to send an email. This way it is not clear what response time that means valid or not valid email.

But you don't know how long sending emails takes, so it will just be a relatively good guess at best which does not help since it can be determined via enough requests…

You are totally correct.
And I just saw your comment in github for using "a 3rd party package that allows to send emails asynchronously", I didn't thought of that at all.

Keep up the good work <3

[GitHub <noreply@…>]

In ca769c8:

Fixed #31505 -- Doc'd possible email addresses enumeration in PasswordResetView.

[Mariusz Felisiak <felisiak.mariusz@…>]

In 04bc3577:

[3.0.x] Fixed #31505 -- Doc'd possible email addresses enumeration in PasswordResetView.

Backport of ca769c8c13df46b8153a0a4ab3d748e88d6e26f9 from master

[Mohammad Almazroa]

Question: why not fix PasswordResetView? documenting it is just not enough.

[Florian Apolloner]

Replying to Mohammad Almazroa:

Question: why not fix PasswordResetView? documenting it is just not enough.

Well, suggestions on fixes are welcome… Unless we want to change the reset view to enter the username (in which case we'd leak usernames instead), I do not see any obvious way on how to fix this.

[Mohammad Almazroa]

Replying to Florian Apolloner:

Replying to Mohammad Almazroa:

Question: why not fix PasswordResetView? documenting it is just not enough.

Well, suggestions on fixes are welcome… Unless we want to change the reset view to enter the username (in which case we'd leak usernames instead), I do not see any obvious way on how to fix this.

"you can use a 3rd party package that allows to send emails asynchronously" .. this is your solution and it's valid. why don't you make the reset view sends emails asynchronously?