Issue Summary: During the recent penetration test, the "Forgot Password" functionality (ForgotPasswordModel) was identified as vulnerable to User Enumeration. Specifically, the application returns distinct error or success messages depending on whether a submitted email address exists in the system database. This allows malicious actors to harvest valid user emails.
Remediation: To comply with security best practices, the response message for the password reset request must be standardized to a generic, non-committal message regardless of whether the email address exists in the system or not.
Current Message :
<div id="AbpPageAlerts">
<div role="alert" class="alert alert-danger alert-dismissible fade show">
Can not find the given email address:test123123123@gmail.com
<button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button></div>
</div>
Proposed Formal Message (to be used in the HTML response / UI):
"If an account matching the provided email address exists in our system, a password reset link has been sent. Please check your inbox and follow the instructions."
1 Answer(s)
-
0
Hi,
The Account module has a setting for this. Go to
Administration > Settings > Account > Generaland enablePrevent email enumeration.After that, the Forgot Password page shows the same message for both registered and unknown emails:
If the provided e-mail address is registered in the system, we will send a password reset link. If you don't get an email within a few minutes, please check your spam box or try again later.
The
/api/account/send-password-reset-codeendpoint also returns the same response in both cases.If you use multi-tenancy, this setting is saved per tenant. Enabling it on the host doesn't change the tenants, so each tenant admin needs to enable it on their own settings page. To enable it for the host and all tenants at once, add this to the
appsettings.jsonof your AuthServer (or the web app if it's not tiered):"Settings": { "Abp.Account.PreventEmailEnumeration": "true" }If you want to use your own text, change the
PreventEmailEnumerationPasswordResetMailSentMessagetext of theAbpAccountresource inAdministration > Language Management > Language Texts.Thanks
Markdown supported.Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)
