User Enumeration in Checkmate Software

Executive Summary

This vulnerability is a user enumeration issue in Checkmate through version 2.1.0. It allows an unauthenticated remote attacker to check if an email address is registered by sending a request to the POST /api/v1/auth/recovery/request endpoint. The server responds with HTTP 200 for registered emails and a different status code for unregistered ones, enabling attackers to identify valid user accounts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor HTTP responses from the POST /api/v1/auth/recovery/request endpoint. Registered email addresses return HTTP 200 while unregistered ones return a different status code. Use tools like curl to test endpoints with known email addresses and observe response codes.

Useful 0 Not Useful 0

Impact Analysis

Attackers can exploit this to gather valid email addresses, which may lead to targeted phishing attacks, credential stuffing, or social engineering attempts against users of the Checkmate system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate data protection regulations like GDPR and HIPAA by exposing personal data (email addresses) without authorization, potentially leading to unauthorized access and privacy breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Checkmate to the latest version beyond 2.1.0. Implement rate limiting on the recovery endpoint to prevent brute-force enumeration. Disable the recovery endpoint if not essential. Monitor logs for suspicious activity targeting this endpoint.

Useful 0 Not Useful 0