possibility to create account without username
State Resolved (Closed)
Disclosed publicly 2018-10-09T11:42:12.226Z
Reported To
Weakness Violation of Secure Design Principles
Bounty
Collapse


Timeline
submitted a report to Infogram .
2018-10-08T11:13:12.415Z

hi ,
infogram.com doesn't allow us to go next untill we give name of our account but i bypassed that. i am able to create an account without any name, just by modify response field.

steps:-

  1. create new account , when you reach page where you have to give your name.
  2. give name and intercept the request , remove first name and last name and forward the request.
  3. now you will get reponse with 400 bad gateway , you just need to remove it and modify with 200 and forward it , your account will be created.

here is the video poc how to create account without any name

regards

Impact

bypass "name giving to account field to complete signup"

Regards,
Frans

kaspars Activities::BugInformative
2018-10-08T12:50:43.281Z
Thanks, but we don't consider a missing name as critical, and it hasn't any security impact. Best regards, Kaspars


the_legend Activities::Comment
2018-10-08T12:59:54.614Z
@kaspars there is **username also missing** which is automatically provided by infogram. username is the identification of user.


kaspars Activities::BugReopened
2018-10-08T13:06:33.456Z


kaspars Activities::BugTriaged
2018-10-08T13:06:55.850Z


kaspars Activities::ReportTitleUpdated
2018-10-08T13:07:52.503Z


the_legend Activities::Comment
2018-10-08T13:10:18.219Z
@kaspars great ;-) thank you so much.


kaspars Activities::BugResolved
2018-10-08T14:25:03.573Z
Thanks, now we ensure that the username is properly created, even if the user manages to skip entering the first/last name. Best regards, Kaspars


the_legend Activities::AgreedOnGoingPublic
2018-10-08T14:29:40.502Z
@kaspars very fast :-) full disclosed ?


kaspars Activities::AgreedOnGoingPublic
2018-10-09T11:42:12.186Z


kaspars Activities::ReportBecamePublic
2018-10-09T11:42:12.244Z