Short Description

User enumeration based on service times

Reporting Date

22. August 2022

Details

During the login request, the user receives information from the backend system about the processing time of the request.

This information, recognizable in the HTTP header x-envoy-upstream-service-time can be used to detect whether the login request is valid user in the system.

Impact

Low

References

• Bug Bounty ID: bf4504a1 (Public)
• Internal ID: INC0024944
• Blog Article: https://blog.abraxas.ch/de/finding/finding-2-timerace

❤ Thanks to

Simon Reinhart for reporting the vulnerability.