Username Enumeration in LogicalDOC Community Edition

Executive Summary

LogicalDOC Community Edition through version 9.3 has a username enumeration vulnerability in the AvatarServlet (/avatar) endpoint. Unauthenticated attackers can exploit this by providing usernames or numeric IDs via the userId parameter. The system responds with 1x1 transparent images for invalid accounts but returns actual avatars for valid ones, allowing attackers to enumerate users and retrieve profile pictures.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the AvatarServlet endpoint (/avatar) responds differently when valid vs invalid user IDs are provided. Send requests with known valid and invalid user IDs and compare responses. A 1x1 transparent image indicates a valid user.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables attackers to identify valid user accounts and potentially gather profile information. While it does not directly allow unauthorized access, it can be used for targeted phishing attacks, social engineering, or reconnaissance to plan further exploits against the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized access to user profile information. The username enumeration flaw allows attackers to identify valid accounts and retrieve profile pictures, which may expose personally identifiable information (PII) under GDPR or protected health information (PHI) under HIPAA. Unauthorized access to such data violates principles of data minimization, access control, and confidentiality required by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update LogicalDOC Community Edition to the latest version beyond 9.3. If an update is not available, restrict access to the /avatar endpoint via firewall rules or disable the AvatarServlet if not required.

Useful 0 Not Useful 0