Atjiu pybbs Information Exposure Vulnerability in Email Verification Endpoint

A vulnerability allowing information exposure has been identified in Atjiu pybbs versions through 6.0.0. The issue arises in the 'sendEmailCode' function within the 'SettingsApiController.java' file. The vulnerability allows for email enumeration by disclosing whether an email is registered through the response message. This flaw can be exploited remotely, and the absence of security measures such as rate limiting or CSRF protection exacerbates the issue.

Impact

Exploitation of this vulnerability leads to unauthorized disclosure of registered users' email addresses.

Reproduction

To reproduce this vulnerability, send a request to the '/api/settings/sendEmailCode' endpoint with an email address as the parameter. The response will indicate whether the email is registered, thereby leaking information about registered users.

Remediation

Users are advised to update to the latest version of Atjiu pybbs, where this vulnerability has been patched.