When a user registers his account via the /knowage/restful-services/signup/create endpoint, the account is blocked by setting
the flgPwdBlocked attribute to true.
// knowage-core/src/main/java/it/eng/spagobi/signup/service/rest/Signup.java
SbiUser user = new SbiUser();
user.setUserId(username);
user.setPassword(Password.encriptPassword(password));
user.setFullName(name + " " + surname);
user.getCommonInfo().setOrganization(defaultTenant);
user.getCommonInfo().setUserIn(username);
user.setFlgPwdBlocked(true);
// […]
int id = userDao.fullSaveOrUpdateSbiUser(user);
However, the /knowage/restful-services/credential/ endpoint, exposed to anonymous users, resets this flag weather the account has been activated or not.
// knowage-core/src/main/java/it/eng/spagobi/api/CredentialResource.java
@PublicService
public Response change(final ChangePasswordData data) {
// [...]
final String userId = data.getUserId();
final String oldPassword = data.getOldPassword();
final String newPassword = data.getNewPassword();
final String newPasswordConfirm = data.getNewPasswordConfirm();
if (StringUtils.isEmpty(userId)) {
// [...]
} else {
ISbiUserDAO userDao = DAOFactory.getSbiUserDAO();
SbiUser tmpUser = userDao.loadSbiUserByUserId(userId);
try {
if (PasswordChecker.getInstance().isValid(tmpUser, oldPassword, newPassword, newPasswordConfirm)) {
// [...]
tmpUser.setFlgPwdBlocked(false);
userDao.updateSbiUser(tmpUser, tmpUser.getId());
// [...]This allows an attacker to register and activate his account without having to click on the link included in the email, which is
useful in the context where the email service is not configured.
It’s also important to note that the registration page does not seem to be displayed when a user accesses the application
without prior authentication.
Impact
An attacker can register and activate his account without having to click on the link included in the email, allowing him to gain access to the application as a normal user.
Patches
You need to upgrade to Knowage 8.1.8 or a later version.
Workarounds
No workaround is available
florents-syn Analyst
When a user registers his account via the /knowage/restful-services/signup/create endpoint, the account is blocked by setting
the flgPwdBlocked attribute to true.
However, the /knowage/restful-services/credential/ endpoint, exposed to anonymous users, resets this flag weather the account has been activated or not.
This allows an attacker to register and activate his account without having to click on the link included in the email, which is
useful in the context where the email service is not configured.
It’s also important to note that the registration page does not seem to be displayed when a user accesses the application
without prior authentication.
Impact
An attacker can register and activate his account without having to click on the link included in the email, allowing him to gain access to the application as a normal user.
Patches
You need to upgrade to Knowage 8.1.8 or a later version.
Workarounds
No workaround is available