Hi,
Once not determined as a vulnerability by security team, I found that autocomplete facility in userreference.module allows anybody to get a complete list of site's user names.
Access to autocomplete function is only aware of 'access content' permission, and at least, it should check also for 'access user profiles' permission (proposed patch attached).
Despite of security team review, I think a website security is compromised when a full list of user names is available for anybody, so 50% of brute force attack consist of discover any valid user name. In addition, when user names are based on other information (like e-mail addresses, customer codes, public identity card numbers...) a user name list is also an e-mail address list, customer list, or whatever.
I think it should be fixed soon, and open a discussion about an unified policy of user names access afterwards.
| Comment | File | Size | Author |
|---|---|---|---|
| userreference-access_user_profiles.patch | 627 bytes | manuel.adan |
Comments
Comment #1
manuel.adanStill no fix for this?
Comment #2
xjmI mentioned this issue to a member of the security team, and the point made was that user names are not considered secret. In fact, I'd add that they're exposed all over the place, in contexts much more direct than this one. If you wish to make this information private on your site, you may need to patch this (and other behaviors) yourself. (A feature request seems unlikely to be committed at this point in the development cycle.)
An aside, for future reference: How to report a security issue