FOSSBilling: Unauthenticated client account enumeration via guest signup endpoint
What fixes it
- 0.8.7FOSSBillingGitHub
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/create endpoint reveals whether a submitted email belongs to a registered client because guest signup returns a distinct unredacted error when the submitted email already exists. The trigger is an unauthenticated request to POST /api/guest/client/create with a target email address. An attacker can compare the guest-signup response for a target email to determine whether the email belongs to an existing FOSSBilling client. Box\Mod\Client\Api\Guest::create returns the error after Client\Service::clientAlreadyExists finds a matching record, and the API response exposes that exception message without redaction. This issue is fixed in version 0.8.7.
Text from CVE List
Affected versions 2
- FOSSBillingaffected: >= 0.1.0, < 0.8.7CVE List
- FOSSBilling<= 0.8.6GitHub
References 4
- github.com/FOSSBilling/FOSSBilling/commit/19f41ff0a45874c7362b7732c8f68db84bc59c55Fixvia CVE List
- github.com/FOSSBilling/FOSSBilling/releases/tag/0.8.7Fixvia CVE List
- github.com/FOSSBilling/FOSSBilling/security/advisories/GHSA-x4mh-g4pc-wfc5Advisoryvia CVE List
- github.com/FOSSBilling/FOSSBilling/pull/4234Referencevia CVE List