HexBrain

Kubernetes · Report #776461

Username enumeration via Openssh 7.6

Informativestatus
mediumseverity
12upvotes
4 Feb 2020disclosed

How it was found

Username enumeration I have found a vulnerability in your site that allows me to verify if an user exits in the ssh due to the use of OpenSSH 7.6p1.

PoC 1 Download and compile the given exploit file 2 open a terminal and run the exploit I have attached a Screenshot if detailed PoC is needed please inform me.

Impact

The attacker can get a list of users available in the ssh.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original