Aranda PassRecovery Active Directory User Enumeration Vulnerability

A user enumeration vulnerability has been identified in Aranda PassRecovery version 1.0. This issue allows attackers to verify the validity of Active Directory user accounts by sending a specially crafted POST request to the '/user/existdirectory/1' endpoint.

Impact

Exploitation of this vulnerability allows for user enumeration, enabling attackers to identify valid Active Directory accounts.

Reproduction

To reproduce this vulnerability, send a POST request to the '/APRAPI//api/v1/user/existdirectory/1' endpoint. Include the Active Directory username in the request body as a JSON string. The response will indicate whether the username is valid or not.