CVE-2022-39315

Executive Summary

CVE-2022-39315 is a user enumeration vulnerability affecting Kirby CMS — a flat-file content management system. The flaw allows an unauthenticated remote attacker to determine whether a specific username exists on a target Kirby site, provided the API and Panel endpoints are enabled. This is achieved through an observable timing discrepancy in the brute force protection mechanism: when the brute force limit is reached, the delay is not applied uniformly, allowing attackers to differentiate between valid and invalid usernames. The vulnerability has been patched in Kirby 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1. Given the CVSS score of 6.5 (medium severity) and the deliberate design of the vulnerability (it only enables targeted, not scalable, brute force attacks), the primary risk is user account enumeration preceding credential-stuffing or targeted phishing campaigns against the identified accounts.

Technical Analysis

The vulnerability resides in the brute force protection mechanism of Kirby CMS. When a user submits authentication credentials to the Panel or via the API, the system tracks failed login attempts per username/IP combination and imposes a delay (rate limiting) after a threshold number of failures. The flaw is that this delay is not inserted when the brute force limit is already reached for an invalid username — however, it is inserted for a valid username.

Vulnerability Mechanism:

The observable discrepancy is a timing side-channel. Consider two scenarios:

1. Invalid username: The system does not find a user record, so the brute force counter (keyed to the input username) never activates a delay. The response returns quickly with a generic "invalid credentials" error.
2. Valid username: The system finds the user record, increments the failed-attempt counter for that username, and after the threshold is crossed, inserts a delay (e.g., a sleep() call) before returning the same generic error.

An attacker iterating through a username dictionary can measure response latency for each attempt. When a username consistently exhibits a longer response time (after several prior failed attempts against it), the attacker can confidently conclude that the account exists.

Attack Surface:

Per the NVD description, the vulnerability affects "all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config." This means the attack surface is the authentication endpoints exposed by Kirby's Panel (the backend admin UI) and the REST API. This is a network-accessible, unauthenticated attack vector that does not require any prior access.

Important Boundary Condition:

The NVD description explicitly notes: "It can only be exploited for targeted attacks because the attack does not scale to brute force." This is because testing each candidate username requires crossing the brute force threshold (multiple failed attempts) to reach the state where the timing differential is observable. This makes mass enumeration impractical — an attacker would need to send several requests per username candidate, and the account lockout delays would slow the process significantly. The attack is therefore geared toward confirming a small list of suspected usernames — for example, names harvested from a company directory or scraped from public content on the site.

Patch Analysis:

The patch (applied in versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1) "rewrote the affected code so that the delay is also inserted after the brute force limit is reached." This indicates the fix applies the same artificial delay regardless of whether the target username is valid or invalid — thereby normalizing the response timing and eliminating the observable discrepancy. Patch confidence is rated 3/4 (LIKELY) because two independent sources (CNA and OSV) confirm the fix.

Exploitation Scenarios

Insufficient technical detail available to specify exact HTTP endpoints, request parameters, or function names beyond what is mentioned in the NVD description. The attack chain is inferred from the vulnerability class (user enumeration via timing side-channel in rate-limiting logic).

Step 1 — Reconnaissance / Target Identification: The attacker identifies a Kirby CMS site. This is feasible via HTTP fingerprinting: Kirby sites often serve distinctive assets, meta tags, or specific response headers. The attacker confirms that the Panel or API is enabled (e.g., by observing a login page or API endpoint responding). The attacker also compiles a list of candidate usernames — typically derived from the organization's email format (e.g., jdoe, j.doe, john.doe) scraped from public sources or common defaults (e.g., admin, editor, author).

Step 2 — Triggering the Flaw: For each candidate username in the list, the attacker submits authentication requests (with arbitrary passwords) via the login mechanism. For each candidate, the attacker sends a sufficient number of failed requests to cross the brute force threshold for that username. The attacker measures the server response time for each request.

Step 3 — Vulnerability-Class Level Execution: The attacker identifies which usernames produce a statistically significant increase in response latency after the threshold is crossed. The delay inserted by the brute force protection for valid usernames acts as a timing beacon. Valid usernames will show a consistent elevated response time; invalid usernames will return quickly without ever triggering the delay. The attacker records the list of confirmed-valid usernames.

No public PoC or exploit code is available; the attack chain is inferred from the described vulnerability class and timing side-channel mechanics.

Step 4 — Post-Exploitation Impact: With a confirmed list of valid usernames, the attacker can pursue several downstream objectives:

• Targeted Credential Stuffing: Run a password-spraying or dictionary attack against the confirmed usernames via the Panel/API authentication endpoint (being mindful of the brute force delay but leveraging distributed sources or slow-spray techniques).
• Phishing: Use the confirmed-valid usernames to craft highly targeted phishing emails impersonating CMS administrators, or to target the CMS login page with a phishing kit.
• Lateral Reconnaissance: The confirmed usernames can be tested against other services of the same organization (e.g., corporate email, VPN) if password re-use is suspected.

Impact Assessment

CVSS Score: 6.5 (Medium) — The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N per the provided score (the exact vector string is not provided, but this representation is consistent with the score and the vulnerability class; the "L:L" integrity component reflects the potential for credential-stuffing follow-up).

Business Impact:

• Confidentiality (Low): The direct information disclosure is limited to the existence of user accounts — a moderate-severity data leak that facilitates further attacks.
• Integrity (Low): The vulnerability itself does not allow data modification; the follow-on credential compromise does, but that is contingent on additional weaknesses.
• Availability (None): The attack does not directly cause denial of service.
• Account Takeover Risk: The enumerated usernames reduce the attacker's search space dramatically, potentially increasing the success rate of password-spraying attacks. For a CMS that often holds website content, an admin account compromise could lead to defacement, malware injection (e.g., malicious JavaScript on public pages), or data exfiltration from the CMS backend.

Affected Systems / Blast Radius: All Kirby CMS installations with user accounts and with the Panel and/or API enabled. The NVD states this encompasses "all Kirby sites with user accounts unless Kirby's API and Panel are disabled in the config." Sites running a hardened configuration with both endpoints disabled are not affected. The attack requires network access to the Panel or API login mechanism.

Exploitability Factors:

• No authentication required (Pre-auth).
• Low attack complexity — no special conditions or race conditions needed.
• No user interaction required.
• The attack is slow and noisy (requires multiple failed requests per username), making it detectable by basic rate-limiting or WAF rules, but not rendering it infeasible.

Detection Guidance

The following detection guidance identifies anomalous patterns of failed authentication attempts and timing anomalies against Kirby CMS login endpoints.

Sigma Rule

title: Kirby CMS User Enumeration via Timing Side-Channel
id: 8f3a6d2c-9e1b-4a7c-8d3e-5b2f9a1c4e7d
status: experimental
description: Detects a high volume of failed login attempts against Kirby CMS Panel/API followed by timing-based anomalies, indicating potential user enumeration via CVE-2022-39315.
author: Valtersit Threat Intelligence
date: 2024/01/15
logsource:
  category: application
  product: kirby
detection:
  selection:
    event.outcome: "failure"
    event.action: "login"
    http.url|contains:
      - "/panel"
      - "/api"
  threshold:
    field: src.ip
    value: 50
  condition: selection
falsepositives:
  - Legitimate users mistyping passwords
  - Automated backup or monitoring tools using stale credentials
level: medium
tags:
  - attack.initial-access
  - attack.t1110
  - cve.2022.39315

YARA Rule

rule KIRBY_CVE_2022_39315_USER_ENUM_TIMING {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detect access log patterns consistent with timing-based user enumeration against Kirby CMS login endpoints"
        date = "2024-01-15"
        cve = "CVE-2022-39315"
        severity = "medium"
    strings:
        $s1 = "login" ascii nocase
        $s2 = "panel" ascii nocase
        $s3 = "api" ascii nocase
        $s4 = "failed" ascii nocase
        $s5 = "invalid" ascii nocase
    condition:
        filesize < 10MB and
        all of them and
        #s1 > 20
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"KIRBY CVE-2022-39315 User Enumeration Attempt — Excessive Failed Logins"; flow:to_server,established; content:"/panel/"; http.uri; content:"login"; http.uri; threshold:type=both, track=by_src, count=30, seconds=60; reference:cve,2022-39315; sid:10039315; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ authentication where event.outcome == "failure" and
      process.name == "php-fpm" and
      url.path in ("/panel/*", "/api/*") ] with runs=10
  [ authentication where event.outcome == "failure" and
      process.name == "php-fpm" and
      url.path in ("/panel/*", "/api/*") and
      // Sudden timing increase suggests valid account delay
      event.duration > 2000ms ]

Splunk SPL Query

index=proxy OR index=apache OR index=nginx 
| where `http_log` 
| search uri_path IN ("/panel/*", "/api/*") AND status=401 
| bin _time span=5m 
| stats dc(uri) as distinct_usernames, count as attempts by src_ip, _time 
| where distinct_usernames > 10 OR attempts > 50 
| stats values(src_ip) as source_ips, list(uri) as attempted_users by _time 
| sort - _time

Wazuh OSSEC Rule

<group name="web,accesslog,">
  <rule id="660319" level="10">
    <if_sid>31100</if_sid>  <!-- Generic web 401 rule -->
    <regex>POST /(panel|api)/.* HTTP/\d\.\d" 401</regex>
    <description>Kirby CMS: Multiple failed Panel/API login attempts — possible user enumeration (CVE-2022-39315)</description>
    <group>authentication_failures,</group>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources — CNA and OSV — confirm the fix.)

1. Immediate Mitigations (if patching is not immediately possible):

• Disable Panel and API if not strictly required for the site's operation. Per the NVD description, sites with both disabled are not affected. This is the most effective workaround.
• Implement network-level restrictions: Restrict access to the Panel and API endpoints via IP allowlists (e.g., only allow corporate/VPN IPs at the web server or firewall layer).
• Deploy a WAF rule that flags or blocks IPs generating an abnormally high number of 401 responses on Panel/API paths.
• Increase the brute force delay threshold in the Kirby config (if exposed) to slow down enumeration attempts further, buying time for patch deployment.

2. Patch / Upgrade Steps:

• Upgrade to one of the fixed versions: Kirby 3.5.8.2, 3.6.6.2, 3.7.5.1, or 3.8.1 (choose the patch for your branch, or the latest 3.8.x if possible).
• After upgrading, verify the patch by re-running the timing test against a staging instance: confirm that response times for valid and invalid usernames are now statistically indistinguishable after crossing the brute force threshold.
• Flush any cached failed-login data in Kirby if the platform stores it persistently, to ensure the brute force counters are reset.

3. Long-Term Hardening:

• Enforce strong password policies for all CMS users, including mandatory multi-factor authentication (MFA) for all Panel logins. This mitigates the post-enumeration credential-stuffing risk.
• Audit user accounts routinely and remove stale or unused accounts — reducing the enumeration target surface.
• Monitor authentication logs for timing anomalies and repeated failures against single usernames, using the detection rules above.
• Leverage a CSPM (Cloud Security Posture Management) or vulnerability scanner that tracks CVE-2022-39315 and alerts on vulnerable Kirby versions.
• Subscribe to Kirby's security advisory feed to receive timely notifications for future vulnerabilities.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-39315
2. Kirby Security Advisory (via OSV): https://osv.dev/vulnerability/CVE-2022-39315
3. GitHub Advisory (assuming standard disclosure): https://github.com/advisories/CVE-2022-39315 (returned 404 — verify manually)
4. Kirby CMS Releases (patch versions): https://github.com/getkirby/kirby/releases (see 3.5.8.2, 3.6.6.2, 3.7.5.1, 3.8.1)
5. EPSS Data (FIRST.org): https://www.first.org/epss/search?q=CVE-2022-39315

Exploit-in-the-Wild Evidence: None reported. The CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public exploit code or PoC is available. EPSS score of 0.00612 (46.2nd percentile) indicates a low — but non-zero — probability of exploitation in the wild. At the time of writing, there are no known threat actor campaigns associated with this CVE. The attack is technically feasible but log-intensive and slow, reducing its attractiveness for mass exploitation.