923682 - User Enumeration

Status: RESOLVED WONTFIX

(Websites Graveyard :: blog.mozilla.org, defect)

Description

[Prajal Kulkarni]

Attachment: User_enum.py

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0 (Beta/Release)
Build ID: 20130910160258

Steps to reproduce:

The site at https://blog.mozilla.org is vulnerable to user enumeration. I was able to list out a long list of valid users by writing a python script.
I have attached my python script below.

Here are few users I could extract:
  [e-mail] 
  [e-mail] 
  seth bindernagel 
  [e-mail] 
  [e-mail] 
  [e-mail] 
  Alex Faaborg 
  Dan 
  [e-mail] 
  Justin Dolske 
  Gen Kanai 
  Axel Hecht 
  mrz 
  [e-mail] 
  [e-mail] 
  [e-mail] 
  Mike Morgan 
  Fred Wenzel 
  Wil Clouser 
  Justin Scott 
  lars 
  [e-mail] 
  lilmatt 
  [e-mail] 
  [e-mail] 
  [e-mail] 
  [e-mail] 
  [e-mail] 
  raccettura 
  [e-mail] 
  [e-mail] 
  [e-mail] 
  [e-mail] 
  [e-mail] 
  Window Snyder 
  [e-mail] 
  [e-mail] 
  [e-mail] 
  [e-mail] 
  Madhava Enros 
  [e-mail] 
  reed 
  Ted Mielczarek 
  [e-mail] 
  [e-mail] 
  Jason Barnabe 
  John Daggett 
  [e-mail] 
  [e-mail] 
  Laura Thomson 
  Dave Mandelin 
  xb95 
  [e-mail]

Comment 1

[Prajal Kulkarni]

Hi Team,

Any updates on this?