rosembergpro/cve-2024-48644Reolink Duo 2 WiFi v1.0.280 - Account Enumeration Vulnerability
September, 2024
CVE: https://www.cve.org/CVERecord?id=CVE-2024-48644
NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-48644
Tenable: https://www.tenable.com/cve/CVE-2024-48644
Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote attackers, unauthenticated, to determine valid user accounts via login attempts. This can lead to the enumeration of user accounts and potentially facilitate other attacks, such as brute-forcing of passwords. The vulnerability arises from the application responding differently to login attempts with valid and invalid usernames.
Reolink Duo Wifi v3.0.0.1889_23031701
Reolink Duo 2 WiFi - https://reolink.com/br/product/reolink-duo-wifi/
This vulnerability can be replicated by attempting to log in with default or common usernames. The application's distinct responses to valid and invalid usernames enable potential attackers to discern valid accounts. Specifically, the application responds with password wrong when a valid username is provided with an incorrect password and login failed when an invalid username is provided.
Outlined below is a three-step proof of concept to reproduce and demonstrate the vulnerability:
Upon accessing the login page, it is observed that the username field is automatically populated with admin. This indicates that admin may be a default username.
When an incorrect password is used, the application responds with a JSON array containing an object. Within this object, the error property includes another object with two properties: detail and rspCode. The detail property specifically returns the message password wrong.
When an invalid username is used, the application responds with a JSON array containing an object. This object includes an error property, which itself contains another object with two properties: detail and rspCode. In this case, the detail property returns the message login failed, indicating that the username does not exist.
To mitigate this Account Enumeration Vulnerability, it is recommended to implement a generic error message for all failed login attempts, regardless of the reason. This means whether a username is valid or not, or whether a password is correct or not, the application should always return a generic message like Invalid username or password. This prevents potential attackers from distinguishing between valid and invalid usernames based on the application's responses.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
OWASP - 04 Testing for Account Enumeration and Guessable User Account
Discovered by Rosemberg Silva
