FileBrowser Quantum Username Enumeration Vulnerability via Authentication Timing Discrepancy

A username enumeration vulnerability has been identified in FileBrowser Quantum versions prior to 1.3.2-beta. The issue arises in the '/api/auth/login' authentication endpoint, which does not process requests in constant time. When an invalid username is provided, the server quickly returns a '401' or '403' response. In contrast, a valid username triggers a bcrypt password comparison, introducing a noticeable delay in the response. This timing difference allows an attacker to distinguish between valid and invalid usernames by measuring response times.

Impact

Exploitation of this vulnerability enables an unauthenticated attacker to enumerate valid usernames by analyzing authentication response times. This could lead to targeted password-guessing attacks, credential stuffing, or social engineering attempts.

Reproduction

The vulnerability can be reproduced by sending requests to the '/api/auth/login' endpoint with a mix of valid and invalid usernames. By measuring the response times, valid usernames can be identified based on the delayed responses caused by the bcrypt password verification process.

Remediation

Users are advised to update to FileBrowser Quantum version 1.3.2-beta, which addresses this vulnerability by ensuring that authentication processes execute in constant time, regardless of username validity.