Information Disclosure in Capgo via Organization UUID Enumeration

Executive Summary

This vulnerability exists in Capgo versions before 12.128.2 in the /private/validate_password_compliance endpoint. The endpoint returns different error responses depending on whether the organization ID provided is malformed, non-existent, or valid. Because of this behavior, unauthenticated attackers can use the differences in response status codes and error messages to enumerate and confirm valid organization UUIDs.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending requests to the /private/validate_password_compliance endpoint and observing the response status codes and error messages. Different responses indicate whether the organization ID is malformed, non-existent, or valid, allowing enumeration of valid organization UUIDs.

For detection, you can use commands like curl to send requests with various organization IDs and analyze the responses. For example:

• curl -i -X POST https://<target>/private/validate_password_compliance -d '{"organization_id":"<test-uuid>"}'

By automating such requests with different UUIDs and checking for differing response codes or messages, you can identify valid organization IDs.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows unauthenticated attackers to discover valid organization UUIDs by analyzing the error responses from the affected endpoint. This information disclosure can lead to further targeted attacks or reconnaissance against the organizations identified, potentially compromising security or privacy.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to enumerate valid organization UUIDs by observing different error responses from the /private/validate_password_compliance endpoint. This information disclosure could potentially impact compliance with standards and regulations that require protection of organizational data and prevention of unauthorized information disclosure, such as GDPR and HIPAA.

However, the provided information does not explicitly describe the direct impact on compliance with these standards or regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the /private/validate_password_compliance endpoint to authenticated and authorized users only, thereby preventing unauthenticated attackers from enumerating organization IDs.

Additionally, updating Capgo to version 12.128.2 or later, where this vulnerability is fixed, is recommended.

If an immediate update is not possible, consider implementing network-level controls such as firewall rules or API gateway policies to limit access to trusted sources.

Useful 0 Not Useful 0