flaskBlog Access Control Vulnerability Leading to Username Enumeration

An access control vulnerability in flaskBlog version 2.6.1 allows attackers to retrieve all usernames by sending a crafted input. The issue arises because the application does not properly validate query parameters, enabling the use of wildcard characters to extract username data from the database.

Impact

Exploitation of this vulnerability results in the unauthorized disclosure of all usernames in the application.

Reproduction

To reproduce this vulnerability, send a request to the search endpoint with a query that includes the wildcard characters '%' or '_'. The server will respond with a list of all usernames that match the query, effectively leaking the entire username database.

Remediation

It is recommended to implement proper validation and filtering of query parameters to prevent unauthorized access to username data.