Prevent VAmPI credential enumeration

api_views/users.py

@@ -98,16 +98,9 @@ def login_user():
                 'auth_token': auth_token
             }
             return Response(json.dumps(responseObject), 200, mimetype="application/json")
-        if vuln:  # Password Enumeration
-            if user and request_data.get('password') != user.password:
-                return Response(error_message_helper("Password is not correct for the given username."), 200,
-                                mimetype="application/json")
-            elif not user:  # User enumeration
-                return Response(error_message_helper("Username does not exist"), 200, mimetype="application/json")
-        else:
-            if (user and request_data.get('password') != user.password) or (not user):
-                return Response(error_message_helper("Username or Password Incorrect!"), 200,
-                                mimetype="application/json")
+        if (user and request_data.get('password') != user.password) or (not user):
+            return Response(error_message_helper("Username or Password Incorrect!"), 401,
+                            mimetype="application/json")
     except jsonschema.exceptions.ValidationError as exc:
         return Response(error_message_helper(exc.message), 400, mimetype="application/json")
     except:

tests/test_enumeration.py

@@ -0,0 +1,9 @@
+from pathlib import Path
+
+
+def test_login_uses_generic_failure_for_unknown_users_and_passwords():
+    source = Path("api_views/users.py").read_text()
+    section = source[source.index("def login_user"):source.index("def token_validator")]
+    assert "Password is not correct" not in section
+    assert "Username does not exist" not in section
+    assert "Username or Password Incorrect!" in section