Reporter Profundis Labs
`Profundis Labs - Security Advisory
Enumeration of existing usernames
Ipswitch, Inc (http://www.ipswitchft.com)
MOVEit File Transfer
MOVEit is an automated file transfer system that lets you manage, view, secure, and control all business-critical file transfer activity through a single, secure system.
MOVEit DMZ v8.1 and below
Vendor Reference Number: MIDMZ-6571
An unauthenticated user can check if a user name exists by using the controller: machine.aspx
By performing a login via XML/Soap the different return codes can be evaluated to check wheather a user exists or not:
ErrorCode 2050 -> Username does not exist
ErrorCode 2025 -> Username exists but password is wrong or user is locked
ErrorCode 0 -> Username exists and right password was provided
POST /machine.aspx HTTP/1.1
<?xml version='1.0' encoding="iso-8859-1" ?>
Vendor Notification: 09/23/2015
Vendor Confirmation: 09/24/2015
Vendor Patch Release: 10/20/2015
Public Disclosure: 01/27/2016
Request Method(s): [+] HTTP GET
Vulnerable Product: [+] MOVEit DMZ v8.1 and below
Authentication (Role): [+] Anonymous
[+] Author: Philipp Rocholl
[+] Website: https://www.profundis-labs.com
[+] Source: https://profundis-labs.com/advisories/CVE-2015-7680.txt
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given.
Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information.