User Enumeration in Veno File Manager Project

Executive Summary

This vulnerability is a user enumeration issue in Veno File Manager Project version 4.4.9. It allows an unauthenticated attacker to check if specific usernames exist by sending crafted POST requests to /vfm-admin/ajax/usr-check.php with a 'user_name' parameter. The application responds differently depending on whether the user exists, enabling attackers to compile lists of valid accounts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor POST requests to /vfm-admin/ajax/usr-check.php. Send crafted requests with varying 'user_name' parameters and check for differing responses indicating user existence. Example: curl -X POST -d 'user_name=testuser' http://target/vfm-admin/ajax/usr-check.php

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to identify valid user accounts on the system. This information could be used for further attacks like brute force attempts, phishing, or social engineering targeting specific users. It compromises user privacy and increases the risk of unauthorized access to sensitive data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate data protection requirements under GDPR and HIPAA by exposing user account information without proper authentication. GDPR requires protecting personal data, and HIPAA mandates safeguarding user identities in healthcare systems. The flaw could lead to non-compliance and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Veno File Manager to the latest version. If unavailable, restrict access to /vfm-admin/ajax/usr-check.php via server configuration (e.g., .htaccess or firewall rules). Disable unauthenticated POST requests to this endpoint.

Useful 0 Not Useful 0