TheArchive/zitadel
1
0
Fork 0
mirror of https://github.com/zitadel/zitadel.git synced 2025-08-11 21:17:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: prevent error reason leakage in case of IgnoreUnknownUsernames (#8372)

Browse Source 
# Which Problems Are Solved

ZITADEL administrators can enable a setting called "Ignoring unknown
usernames" which helps mitigate attacks that try to guess/enumerate
usernames. If enabled, ZITADEL will show the password prompt even if the
user doesn't exist and report "Username or Password invalid".
Due to a implementation change to prevent deadlocks calling the
database, the flag would not be correctly respected in all cases and an
attacker would gain information if an account exist within ZITADEL,
since the error message shows "object not found" instead of the generic
error message.

# How the Problems Are Solved

- Proper check of the error using an error function / type and
`errors.Is`

# Additional Changes

None.

# Additional Context

- raised in a support request

Co-authored-by: Silvan <silvan.reusser@gmail.com>
This commit is contained in:
Livio Spring
2024-07-31 14:23:57 +02:00
committed by GitHub
parent 189505c80f
commit a1d24353db
6 changed files with 207 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
internal/command/user_human_password.go
View File

@@ -16,6 +16,15 @@ import (
"github.com/zitadel/zitadel/internal/zerrors"
)
var (
ErrPasswordInvalid = func(err error) error {
return zerrors.ThrowInvalidArgument(err, "COMMAND-3M0fs", "Errors.User.Password.Invalid")
}
ErrPasswordUnchanged = func(err error) error {
return zerrors.ThrowPreconditionFailed(err, "COMMAND-Aesh5", "Errors.User.Password.NotChanged")
}
)
func (c *Commands) SetPassword(ctx context.Context, orgID, userID, password string, oneTime bool) (objectDetails *domain.ObjectDetails, err error) {
ctx, span := tracing.NewSpan(ctx)
defer func() { span.EndWithError(err) }()
@@ -393,10 +402,10 @@ func convertPasswapErr(err error) error {
return nil
}
if errors.Is(err, passwap.ErrPasswordMismatch) {
return zerrors.ThrowInvalidArgument(err, "COMMAND-3M0fs", "Errors.User.Password.Invalid")
return ErrPasswordInvalid(err)
}
if errors.Is(err, passwap.ErrPasswordNoChange) {
return zerrors.ThrowPreconditionFailed(err, "COMMAND-Aesh5", "Errors.User.Password.NotChanged")
return ErrPasswordUnchanged(err)
}
return zerrors.ThrowInternal(err, "COMMAND-CahN2", "Errors.Internal")
}