567772 - Email Harvesting Possible from Public Job Files

Status: VERIFIED FIXED

(Websites :: Other, defect)

Description

[Michael Coates [:mcoates] (acct no longer active)]

Issue

Completed jobs are publicly viewable to unauthenticated users.  An attacker could create a script that would systematically attempt to enumerate valid job IDs by incrementing through the name space of the job identifiers. For each valid job identifier the attacker could extract the username (email address) and use this for brute force attacks or to target the user with phishing or spam emails.

The overall risk of this issue is low due to the low likelihood of an attack since a relatively large space of potential job IDs would need to be enumerated for a relatively low payoff (i.e. just obtaining the email address).

Example URL:
http://dm-sixgill01.mozilla.org/scripts/jobs/HXONSPMEZW.job


Recommended Remediation

If possible completely restrict access to the .job files. If access is required then ensure the user is authenticated before they are able to view the job file.

Comment 1

[Brian Hackett [Laid off!]]

Hi, the .job files don't need to be publically accessible, I modified the .htaccess files on the server to make them inaccessible.

Comment 2

[Michael Coates [:mcoates] (acct no longer active)]

Looks good to me. Marking this one fixed.