RockteMQ-AI commented on issue #4159:
URL:
https://github.com/apache/rocketmq-dashboard/issues/4159#issuecomment-5586407710
## Bot Evaluation
**Classification:** Bug — Security (HIGH)
**Verification:** ✅ Confirmed via code analysis
### Analysis
Verified against
`server/src/main/java/org/apache/rocketmq/studio/auth/AuthService.java`, method
`loginDatabaseUser()` (lines ~264-272):
```java
RmqStudioUser user = findUserByUsername(request.getUsername())
.orElseThrow(() -> new BusinessException(401, "Invalid username or
password"));
if (!Boolean.TRUE.equals(user.getEnabled())) {
throw new BusinessException(403, "User account is disabled"); //
before password check
}
if (!passwordHasher.matches(request.getPassword(), user.getPasswordHash())) {
throw new BusinessException(401, "Invalid username or password");
}
```
The `enabled` check (403) executes before the password comparison (401),
creating two security issues:
### Security Impact
1. **Account enumeration:** An attacker can distinguish between non-existent
users (401), disabled accounts (403), and valid active accounts (401 after
password mismatch). The distinct 403 response for disabled accounts reveals
their existence.
2. **Rate-limit bypass:** If rate limiting is tied to failed password
attempts, disabled accounts never reach the password check, so brute-force
attempts against disabled accounts bypass rate limiting entirely.
### Recommended Fix
Check the password **first**, then check the enabled status. This ensures:
- Invalid credentials always return 401 regardless of account state (no
information leakage).
- Rate limiting applies uniformly to all login attempts.
```java
// Correct order:
if (!passwordHasher.matches(request.getPassword(), user.getPasswordHash())) {
throw new BusinessException(401, "Invalid username or password");
}
if (!Boolean.TRUE.equals(user.getEnabled())) {
throw new BusinessException(401, "Invalid username or password"); //
same message
}
```
The included regression tests
(`loginShouldNotRevealDisabledAccountsBeforeThePasswordIsVerified`) correctly
validate the expected behavior.
**Verdict:** Confirmed security bug. Fix PR recommended.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
