GHSA-724c-6vrf-99rq: 
JavaScript vulnerability analysis and mitigation

A sensitive data exposure vulnerability was identified in the loopback framework, affecting versions prior to 3.26.0 (3.x) and 2.42.0 (2.x). The vulnerability was discovered on May 13, 2019, and published to the GitHub Advisory Database on September 2, 2020. The issue allows unauthorized access to user information through invalid API requests to the login endpoint, potentially exposing information about the first user in the database (GitHub Advisory, Loopback Security).

The vulnerability stems from the built-in User model's login method, which incorrectly allows search criteria objects to be passed as values for email, username, and realm parameters. Using conditional properties like 'neq' and 'regexp', attackers can craft unspecific but valid username or email queries to exploit the system. The vulnerability is classified as CWE-200 and has been assigned a Low severity rating (Loopback Security).

When exploited, this vulnerability can lead to sensitive data exposure by revealing information about the first user in the database. This information can be leveraged alongside other attacks for credential theft, potentially compromising user accounts (GitHub Advisory).

The vulnerability can be exploited by sending specially crafted requests to the /Users/login endpoint. An example exploit involves sending credentials with an email parameter containing an 'neq' condition and any password value, which could return information about the first user in the database (GitHub Issue).

Users are advised to upgrade to patched versions: loopback 3.26.0 or later for LoopBack 3.x users, and loopback 2.42.0 or later for LoopBack 2.x users. The fix ensures that User.login no longer accepts objects as parameters, requiring email, username, and realm values to be strings, otherwise returning a 400 Bad Request error (Loopback Security).