Executive brief
LoopBack is a framework for building backend applications and APIs. A flaw in the user login endpoint allows an attacker to bypass email validation using query operators, causing the system to return information about the first user in the database instead of validating credentials properly. An attacker can exploit this to enumerate user accounts and extract data needed for credential theft.
Technical details
This vulnerability is a CWE-200 (Sensitive Data Exposure) affecting the User model's login endpoint. The root cause is improper input validation on the email parameter in the POST /Users/login route, which fails to enforce string-type constraints. An attacker can send a JSON object with query operators (e.g., {"neq": "foo"}) instead of a string, bypassing email validation and causing the login function to return details of the first user in the database. No authentication is required; the attack is network-accessible via an HTTP POST request. Patches are available in loopback 2.42.0 (2.x) and 3.26.0 (3.x) or later.
Affected products
- StrongLoop LoopBack 2.0.0 to 2.41.x, 3.0.0 to 3.25.x
Timeline
- 2019-05-13: disclosed: Vulnerability reported via GitHub issue
- 2020-09-02: advisory: GHSA advisory published
- 2020-09-02: patched: Fixes available in loopback 2.42.0 and 3.26.0