Hiding a Signup Button Isn't Security: From Client-Side Controls to Cross-Tenant Data Exposure

The article discusses a series of vulnerabilities found in an application that allowed an unauthenticated attacker to escalate privileges and access sensitive data across multiple organizations. Here's a summary of the key points:

1. Hidden Signup: The signup button was hidden on the frontend, but the backend still accepted signups.

2. Public JavaScript Configuration: The application exposed configuration variables like USER_SIGNUP: false in public JavaScript files.

3. Signup API: Despite the hidden signup button, the /people/ endpoint allowed new users to register.

4. Confirmation Token: Upon signing up, a confirmation token was returned in the response instead of being sent via email for verification.

5. Authentication Token: The attacker could use the confirmation token to authenticate and obtain an authentication token.

6. Privilege Escalation: By modifying their user profile through the /people/{uuid}/ endpoint, users could set is_staff: true, granting administrative privileges.

7. Tenant Isolation Testing: With staff-level access, the attacker tested if the API correctly enforced tenant boundaries and found that it did not, allowing cross-tenant enumeration of users.

8. Domain API Keys Exposure: The /domains/ endpoint exposed sensitive information such

Read the full article at InfoSec Write-ups - Medium

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.