11 matches found
Multiple user accounts via same email and username
Description Nakama console does not validate uppercase/lowercase letters when creating a new user. This can be abused to create multiple user accounts with same email and username. Proof of Concept HTTP Request 1 request POST /v2/console/user HTTP/1.1 Host: 192.168.1.16:7351 Authorization: Bearer...
WS-2022-0443
Nakama console through 3.15.0 does not validate uppercase/lowercase letters when creating a new user. This can be abused to create multiple user accounts with same email and username...
WS-2022-0445
There is UI discrepancy in the user password section in nakama console up to 3.15.0. The UI presents the following message to the user for a short password: "Password is required, must be 8 chars or longer and consist of at least a capital letter, a small letter and a number". However, the backen...
Insufficient Session Expiration
Description The Nakama Console session is not invalidated when the user is deleted. Proof of Concept Steps to reproduce: 1. Log in to the Nakama Console as admin and create a user [email protected] 2. In a separate browser or private window log in to the account [email protected] 3. In the admin session,...
User Enumeration via Response Timing
Description There is a significant timing difference in the login functionality of the Nakama Console for valid and invalid email addresses or usernames. Proof of Concept 1. Login to the Nakama Console as admin and create a User [email protected] 2. Logout 3. Attempt a Login with an incorrect passwor...
WS-2022-0448
Insufficient Session Expiration exists in heroiclabs/nakama through 3.15.0. The Nakama Console session is not invalidated when the user is deleted. An old session can be used by an attacker even after the user has been deleted in a different session. The session can be used until it expires or th...
GHSA-8R94-4H3C-939F Improper Restriction of Excessive Authentication Attempts
Nakama Console does not enforce any limit for the number of unsuccessful login attempts...
Improper Restriction of Excessive Authentication Attempts
Nakama Console does not enforce any limit for the number of unsuccessful login attempts...
User Account Deletion and more via Clickjacking
Description As nakama console is not restricted from being loaded in an iframe, clickjacking attack is possible. Proof of Concept 1. Login to nakama console. 2. Save the following as an .html file and open it in the browser to see that the page loads into an iframe. html :"...
No Protection against Bruteforce attacks on Login page
Description Nakama Console does not have any limit for the number of unsuccessful login attempts in a very short period of time. Proof of Concept 1. Send a login request. 2. Capture the login request 3. Replay the login request with different password value. HTTP request http POST...
PT-2022-3493
Name of the Vulnerable Software and Affected Versions heroiclabs/nakama versions prior to 3.13.0 Description The issue is related to an improper restriction of excessive authentication attempts, which can lead to login brute-force attacks. This allows a remote attacker to gain unauthorized access...