Document password hash disclosure in User Update API

[elit3pwner]

The user update API exposes password hashes in the response, which poses a security risk. Recommendations include excluding the password field from API responses and implementing dedicated password management endpoints.

Password Hash Disclosure in User Update API

Severity

HIGH

CVSS Score & Vector

CVSS v3.1: 7.5 (High)
Vector: AV:N / AC:L / PR:L / UI:N / S:U / C:H / I:N / A:N

Vulnerability Description

The user update API endpoint returns the user's password hash in the HTTP response body after a successful update request. Although the password is stored using a strong hashing algorithm (pbkdf2_sha256), exposing password hashes constitutes disclosure of sensitive authentication material.

Password hashes must remain strictly server-side. Their exposure enables offline password cracking, facilitates credential reuse attacks, and significantly increases the impact of other vulnerabilities such as IDOR, XSS, or token compromise.

This issue indicates improper serialization of the User model, resulting in the inclusion of the password field in API responses.

---

Proof of Concept

Request

PATCH /api/users/26/ HTTP/2
Host: dev-us-west-1.aixblock.io
Content-Type: application/json
Cookie: sessionid=<valid_session_cookie>

{
"first_name": "test",
"last_name": "user"
}

Response

HTTP/2 200 OK
Content-Type: application/json

{
"id": 26,
"username": "testuser",
"email": "user@example.com
",
"password": "pbkdf2_sha256$26HGYxAMAF7Tzg$D/wsmvVBUicTt7Y1vohQvrwWjw52gDoeYvXq2VHzNPU=",
"is_active": true,
"is_verified": true
}

The password field containing the password hash is returned directly in the API response.

---

Impact

High — enables offline password cracking, credential reuse attacks, and significantly increases the blast radius when chained with other vulnerabilities.

---

Recommendation

• Exclude the password field from all API serializers used in responses.
• Mark password fields as write_only where input is required.
• Implement dedicated password management endpoints for password changes.
• Conduct a review of all API responses to ensure no sensitive authentication material is exposed.

---

Reference Links

• https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure/
• https://cwe.mitre.org/data/definitions/522.html
• https://cwe.mitre.org/data/definitions/532.html
• https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html
• https://docs.djangoproject.com/en/stable/topics/auth/passwords/

Screenshot: