Sensitive Information Disclosure via /auth/info in eladmin ≤ 2.7(CWE-200)

[ez-lbz]

Sensitive Information Disclosure via /auth/info in eladmin ≤ 2.7(CWE-200)

Summary

In eladmin versions up to 2.7, the /auth/info endpoint returns user information without filtering entity fields. As a result, sensitive data including the user’s password hash is mistakenly returned, creating a risk of offline password brute-force attacks.

Vulnerability Description

When logged-in users request /auth/info, the server returns all entity fields without filtering, including the user password hash.

Vulnerability details

Sending the following request shows that the response includes the user’s password hash.

This field is not used on the frontend.

This leads to a risk of offline password cracking.

Impact

• Exposure of password hashes to authenticated users

• Risk of offline password brute-force attacks

Remediation

Filter entity fields at the DTO layer to return only the necessary fields required by the frontend.

[sudo-Yangziran]

I want to if this hole requires authorization?