YesWiki User Enumeration via LostPasswordAction

Executive Summary

YesWiki before version 4.6.7 has a user enumeration vulnerability in LostPasswordAction.php. Unauthenticated attackers can submit email addresses to the password recovery page and receive different responses based on whether the email is registered. This allows attackers to confirm valid accounts for phishing or password-spraying attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, you can send HTTP POST requests to the password recovery endpoint with different email addresses and observe the responses. A valid account will return a success message while an invalid one will show an error. Example using curl: curl -X POST -d 'email=test@example.com' http://target.com/?wiki=LostPasswordAction. Compare responses for 'success' vs 'email not registered' messages.

Useful 0 Not Useful 0

Impact Analysis

Attackers can identify valid email accounts to target with phishing or password-spraying attacks. This could lead to unauthorized access to accounts if users reuse passwords or fall for phishing attempts. The lack of rate limiting enables large-scale probing of accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by exposing user email addresses through user enumeration. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. Unauthorized disclosure of registered emails may violate these regulations if user accounts contain sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade YesWiki to version 4.6.7 or later. As a temporary measure, implement rate limiting on the password recovery endpoint and add CAPTCHA protection. Modify LostPasswordAction.php to return the same generic message for all requests regardless of account existence while still sending reset emails only to valid accounts.

Useful 0 Not Useful 0