Server: Username validation is possible via bruteforce

[dsommers]

Steps to reproduce

1. Try logging in with a username and password
2. Get the reset password error
3. The error on invalid usernames says: "Could not send reset mail. Please make sure your username is correct"

Expected behaviour

The error message in this case should not hint on a wrong user name. It could rather say: "Reset e-mail sent. If you have not received it within 10 minutes, contact your administrator".

Rationale

This is to make it unclear if a username exists or not. If an attacker does not know if a username is correct, various bruteforce attacks are much harder to achieve. It is also fairly trivial to mount an HTTP attack against a web server to try various usernames. It doesn't even have to run fast, one attempt every 5 minutes is often enough to hide what's going on. On a busy server, you probably will not notice anything at all. And it will take roughly 17-18 days to check a list of 5000 usernames with 5 minutes in between each check.

[rullzer]

@LukasReschke

[coder-hugo]

Additionally the nextcloud prints the message "Incorrect password" if you have entered the correct username but a wrong password. Which gives an attacker the hint that this user exists.
See here for more information about how to implement authentication properly.
Furthermore I would label this with security not bug.

[skjnldsv]

I'm guessing this is not possible anymore with the auto exponential timeout on failed login?

[kesselb]

Should be fixed by https://github.com/nextcloud/server/pull/13595 for Nextcloud 16.