Information Disclosure in OpenSignLabs OpenSign

Executive Summary

This vulnerability allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function in OpenSign through 2.37.0. The function lacks authentication checks before resolving and returning the internal identifier, enabling attackers to enumerate user accounts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can test if the getUserId Parse cloud function in OpenSign 2.37.0 or earlier allows unauthenticated requests to resolve email addresses or usernames to internal user IDs. Send a GET or POST request to the vulnerable endpoint with a test email or username and check if it returns an internal user objectId without authentication.

Useful 0 Not Useful 0

Impact Analysis

Attackers can use this to identify valid user accounts, which may lead to targeted phishing, brute force attacks, or other social engineering attempts. It exposes internal user identifiers that could be used in further exploits.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate data protection requirements under GDPR and HIPAA by exposing personal identifiers without proper access controls. It undermines user privacy and could lead to non-compliance with security and privacy standards.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update OpenSign to the latest version beyond 2.37.0, as the vulnerability is patched in newer releases. If an update is not available, disable the getUserId Parse cloud function or restrict access to authenticated users only. Review server logs for suspicious requests attempting to enumerate user accounts.

Useful 0 Not Useful 0