Timing Attack in Gophish Admin Login

Executive Summary

Gophish through version 0.12.1 has a timing discrepancy vulnerability in the AdminServer.Login function. This flaw allows unauthenticated attackers to check if a username exists by measuring how long the system takes to respond to login attempts. The system uses bcrypt for password hashing, which takes longer for valid usernames, enabling attackers to distinguish between existing and non-existing accounts.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor login response times for POST requests to /login in Gophish. Existing accounts will show delayed bcrypt comparisons compared to non-existent ones. Use tools like curl to send test requests and measure response times for different usernames.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to identify valid usernames in your system, which they can then use for further attacks like password guessing or credential stuffing. If you use Gophish for phishing simulations or email campaigns, attackers could exploit this to target specific users within your organization.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows unauthenticated attackers to enumerate valid usernames by measuring login response times, which could lead to credential stuffing attacks. This may violate GDPR's data protection principles requiring appropriate security measures to prevent unauthorized access to personal data, and HIPAA's safeguards for protecting electronic protected health information (ePHI) by enabling unauthorized access to user accounts.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Gophish to a version beyond 0.12.1 where this issue is fixed. If upgrading is not possible, implement rate limiting on the /login endpoint and disable timing-based username enumeration by modifying the login logic to return consistent response times.

Useful 0 Not Useful 0