Username Restriction is not applied for reserved folders
G
Gratipay
Submitted None
Actions:
Reported by
akash_9021
Vulnerability Details
Technical details and impact analysis
Hi,
This issue is same as #128121 reported by a5tronaut.
He reported some of the usernames for restriction and you applied check only for those usernames.
I think username restriction should applied for all the usersnames, those are used for a directory or a link in gratipay.
a5tronaut mentioned the sign-out.html. You restricted it but sign-out still is an available username.
Like gratipay have the directory listing for following:
Profile, Giving , History, Emails, Routes, Settings.
But none of the above is restricted for use as an username.
I created my account of three of above username for POC purpose. When User of gratipay will click on the following link, he would expect the history, sign-out, settings page of gratipay. But he will end up visiting my gratipay account.
**POC:**
https://gratipay.com/sign-out/
https://gratipay.com/History/
https://gratipay.com/settings/
**Fix:**
You can fix most of this username restriction issues by not allowing . (dot) in username as i suggested in my previous report and other usernames without "." dot can be restricted explicitly.
Thanks,
Akash Saxena
Report Details
Additional information and metadata
State
Closed
Substate
Informative
Submitted
Weakness
Violation of Secure Design Principles