Username Spoofing via Unicode Sanitization in StoaChat

Executive Summary

This vulnerability affects the stoatchat application before version 0.15.5. It involves a failure to revalidate usernames after Unicode sanitization. Attackers can submit Unicode letters that transform into forbidden characters during sanitization, bypassing initial validation rules. This allows creation of usernames with disallowed characters, special characters, or exceeding the 32-character limit.

Useful 0 Not Useful 0

Detection Guidance

Check if your stoatchat instance is running a version before 0.15.5 by running: stoatchat --version. Inspect usernames for unusual characters or lengths exceeding 32 characters. Look for accounts with names containing Unicode characters that may transform into forbidden characters after sanitization.

Useful 0 Not Useful 0

Impact Analysis

Attackers could create usernames that appear as reserved names or bypass restrictions, potentially impersonating other users or creating confusion. The sanitized usernames can expand up to 160 characters, causing display issues or problems in downstream systems that process usernames.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade stoatchat to version 0.15.5 or later immediately. Review and remove any suspicious usernames that may have bypassed validation. Implement additional server-side validation to recheck usernames after Unicode sanitization.

Useful 0 Not Useful 0