PwnDoc up to version 0.5.3 allows remote attackers to identify valid usernames by exploiting response timings during authentication attempts.

ProductCVECVSSv3 ScoreCWE
PwnDocCVE-2022-440225.3 (Medium)CWE-307

Exploitation Steps

This vulnerability allows username enumeration in PwnDoc (tested on version 0.5.3 - 2022-07-19 and earlier) by observing web server response timings during login attempts.

Example Scenario:

Suppose the following users are registered in PwnDoc: List of valid users registered in PwnDoc for the username enumeration attack

A dictionary-based brute force attack can be performed by sending a list of usernames via POST login requests. Example of POST login request for username enumeration attack in PwnDoc

By analyzing the server’s response timings, an attacker can identify:

  • Long response times: Valid users
  • Short response times: Invalid users

Resources: