Silverpeas Username Enumeration Vulnerability in Forgot Password Endpoint

A username enumeration vulnerability has been identified in Silverpeas versions 6.4.1 and 6.4.2. The issue resides in the Forgot Password endpoint of the CredentialsServlet. By sending POST requests with usernames in the Login parameter, remote attackers can discern valid usernames based on the differing HTTP response status codes. A status of 200 OK indicates a valid username, while 302 Found signifies an invalid one.

Impact

Exploitation of this vulnerability allows for username enumeration, enabling attackers to identify valid usernames on the system.

Reproduction

The vulnerability can be reproduced by sending POST requests to the /CredentialsServlet/ForgotPassword endpoint with usernames in the Login parameter. The server's response can be monitored for status codes: 200 OK for valid usernames and 302 Found for invalid ones. This process can be automated with a Python script that uploads the usernames and checks the response status codes.

Remediation

Users can upgrade to Silverpeas version 6.4.3, which addresses this vulnerability.