Open eClass Username Enumeration Vulnerability

A username enumeration vulnerability has been identified in the Open eClass platform, prior to version 4.2. This vulnerability allows unauthenticated attackers to determine valid user accounts by exploiting inconsistencies in the login response. When a valid username is entered, the response includes a session cookie, whereas an invalid username does not. This discrepancy can be leveraged to automate the identification of valid usernames.

Impact

Exploitation of this vulnerability allows for reliable identification of valid usernames, which could be used in further attacks, such as password guessing or phishing.

Reproduction

To reproduce this vulnerability, send requests to the login endpoint with a list of usernames. Observe the response headers: valid usernames will trigger a response that includes a session cookie, while invalid usernames will not. This difference can be used to create an automated tool for username enumeration.

Remediation

Users are advised to update to Open eClass version 4.2 or later.