Hot on the heels of yesterday's User management fail post comes User management fail 2! More shocking discoveries! Blood! Gore!

Well, perhaps not, but still a fairly massive security fail.

Background

I'm interviewing for a project doing Zimlets for Zimbra and as part of the preparation I'm looking at existing Zimlets to see how they're done (the Zimlets are located at gallery.zimbra.com should you be interested in having a look). One of the Zimlets I looked at seemed to have code useful to the project and I wanted to download it - but found no download button. Instead, I spied a login/register combo and figured I had to register first, which I then did. Back on the original page, I then tried to login with my new info.

Fail

When trying to log in, I got an error message, something about lacking permissions for a given area. Not a huge fail, but not really smart either (I registered using the button right next to the login button that doesn't let me in - if I cannot register for the area the login button controls, then DON'T DISPLAY a register button there). No, the real fail lies with the error output - have a look at the image below:

It's always good to have descriptive error outputs, and if you're debugging stuff, then extra output is fantastic. But even though I have seemingly managed to get the 'eleet' ID, it's less than stellar performance that they choose to tell me. And the fact that they're outputting password hash is downright stupid. Though, of course, the password hash itself wouldn't get you far, because at Zimbra, passwords are also protected by salts, making a bruteforce attack very hard ... unless you know the salt. Which Zimbra happily displays right alongside the password hash on the login fail screen.

There is a factor mitigating this: the output is only displayed for logins that are successful, i.e. you actually have to know the proper user/pass combination to get it, so you cannot just start leeching password hashes from the site. The good news only goes so far, though: any man-in-the-middle has free access to all the data, as the login happens over http and not https.

Note: I have contacted Zimbra about this.