Closed Registration form allows probing emails

K

Kirby

Well-known member
Licensed customer
Affected version
2.2.16
Prerequisites
  1. At least one custom field is required to be filled out during registration
Steps to reproduce
  1. Open the registration form
  2. Using browser developer tools, remove attribute required from the required custom field
  3. Enter a random gibberish username
  4. Enter the email address to check
  5. Fully complete the registration form and submit it
  6. Examine the results
Result
An error message stating that the required custom field is missing.
If the email address is already in use there is also an error stating this.
This allows large amounts of emails to be checked for already having an account by repeating those steps.

Suggested Mitigation

CAPTCHA already helps (a bit) with this, but further mitigation seems to make sense
  1. Limit the amount of registration attempts a single IP address can make within a certain time (like login strikes)
  2. If there are multiple errors and the email address is already in use don't show this error but only the other errros
    This slightly decreases usability but would IMHO be acceptable to harden the registration process
  3. Optionally fully ban an IP address if it exceeds X "email already in use" errors
 
Automated triage: Design issue

Thank you for reporting this issue. The registration form checks whether an email address is already used by an account and reports it alongside any other errors. Apart from CAPTCHA, it does not limit how often one visitor can try. The lost-password form also says when no account matches an email, so changing this is a design decision rather than a bug fix.

This is an automated assessment. A member of staff may review and update it.
 
Back
Top Bottom