895269 - account.services.mozilla.org - Captcha does not prevent account-existence testing

Status: RESOLVED WONTFIX

(Cloud Services :: General, defect)

Description

[mriazebrahim]

I have found a vulnerability on your password reset page - https://account.services.mozilla.com/forgot

This vulnerability allows attacker to conduct account harvesting attack. This above affected link is used for resetting the user password. Usually the Captcha is implemented in reset password pages to avoid automatic email generation to avoid account harvesting using automated way. 
Account harvesting attack is the the process of collecting the  valid user list using automated way by analyzing the response message of give user ID in the page.

Your captcha on this page have a securiy hole.

Steps - 
1) Go to https://account.services.mozilla.com/forgot
2) Enter invalid userid (which is not yet registered with mozilla)
3) Click register button without entering captcha
4) The response message shows as "Unable to locate your account. Please check your username. "
So you can automate this request (without providing the captcha value) to collect the list of registered email address (by analyzing the response message)

As per security standpoint, every request should have the captcha validation before proceeding to next page

Comment 1

[Curtis Koenig [:curtisk-use curtis.koenig+bzATgmail.com]]]

(In reply to mriazebrahim from comment #0)
> 3) Click register button without entering captcha
There is no register button on this page, only "Email Reset Key". So while you could guess a username you can not guess the email nor get any access to the sync keys or other sensitive information