Zulip Server Information Disclosure Vulnerability

An information disclosure vulnerability has been identified in Zulip Server versions 7.0 and above. When a server hosts multiple organizations, an unauthenticated user can send a request to the '/api/v1/fetch_api_key' endpoint and determine if a specific email address is associated with a user account. This issue arises because the server responds with an 'invalid subdomain' error when an email address does not exist on the requested subdomain, but does on another, allowing the attacker to infer the existence of the account.

Impact

Exploitation of this vulnerability allows for unauthorized information disclosure, specifically revealing whether an email address is associated with a user account on the Zulip server.

Reproduction

To reproduce this vulnerability, send a request to the '/api/v1/fetch_api_key' endpoint using an email address that exists on a different subdomain of the Zulip server. The server will respond with an 'invalid subdomain' error, indicating that the email address is in use on another subdomain, thereby disclosing information about the account's existence.

Remediation

Users are advised to upgrade to Zulip Server version 9.4 or later. Instructions for upgrading can be found in the Zulip documentation.