CVE-2024-13028

Executive Summary

CVE-2024-13028 is a problematic vulnerability in Antabot White-Jotter up to version 0.2.2. The issue lies in the /login endpoint, where manipulation of the username argument leads to an observable response discrepancy. This is a classic information disclosure vulnerability (CWE-204) that allows an attacker to enumerate valid usernames by analyzing differences in server responses (e.g., error messages, response times, or HTTP status codes). The attack complexity is high, and exploitation is difficult, but a public proof-of-concept exists. No patch is currently available.

Supply Chain & Package Security

This vulnerability affects the Antabot White-Jotter application, which is a Java-based web application. It is not an NPM, PyPI, Go, or Ruby package. However, if White-Jotter is deployed via a container image or as part of a CI/CD pipeline, the supply chain risk includes the potential for an attacker to identify valid usernames, which could then be used in targeted credential-stuffing or phishing attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score not provided by NVD, calculated as 3.1 Low)
• Attack Vector (AV): Network (N) - The attack can be launched remotely.
• Attack Complexity (AC): High (H) - Exploitation requires specific conditions or knowledge.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited information disclosure (username enumeration).
• Integrity (I): None (N) - No data modification.
• Availability (A): None (N) - No impact on availability.
• Threat Level: Low. The attack is difficult to exploit, and the impact is limited to information disclosure.

Deep Dive & Mechanics

The vulnerability is a classic Observable Response Discrepancy (CWE-204). When a user submits a login request to /login, the application processes the username parameter. If the username exists in the system, the server returns a different response (e.g., "Invalid password") compared to a non-existent username (e.g., "Invalid username"). This difference allows an attacker to enumerate valid usernames.

The attack is performed by sending multiple login requests with different usernames and analyzing the responses. The high attack complexity suggests that the response discrepancy might be subtle (e.g., different HTTP status codes, response times, or error messages that are not immediately obvious). The exploit has been publicly disclosed, meaning that proof-of-concept code is available.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable behavior.

Vulnerable Code (Conceptual):

// Vulnerable: Different responses for existing vs. non-existing users
if (userExists(username)) {
    return "Invalid password";
} else {
    return "Invalid username";
}

Patched Code (Recommended):

// Patched: Generic response regardless of user existence
if (authenticate(username, password)) {
    return "Login successful";
} else {
    return "Invalid username or password";
}

Exploitation & Lab Setup

Red Team

1. Setup: Deploy Antabot White-Jotter v0.2.2 in a lab environment (e.g., Docker container).
2. Enumeration: Use a script to send POST requests to /login with different usernames.
3. Analysis: Compare responses (e.g., HTTP status codes, response body, response time).
4. Exploitation: Once valid usernames are identified, use them in credential-stuffing attacks.

Example Python Script:

import requests

target = "http://target.com/login"
usernames = ["admin", "user", "test", "root"]

for username in usernames:
    data = {"username": username, "password": "wrong"}
    response = requests.post(target, data=data)
    print(f"{username}: {response.status_code} - {response.text[:50]}")

Blue Team

1. Detection: Monitor for multiple login attempts with different usernames from the same IP.
2. Mitigation: Implement rate limiting on the /login endpoint.
3. Response: If username enumeration is detected, block the offending IP and investigate.

Indicators of Compromise (IOCs)

• Network: Multiple POST requests to /login with varying username parameters from a single source IP.
• Logs: Repeated login failures with different usernames.
• Response Patterns: Differences in response body or status codes for different usernames.

Detection Engineering

YARA Rule

rule CVE_2024_13028_Username_Enumeration {
    meta:
        description = "Detects attempts to exploit CVE-2024-13028 username enumeration"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13028"
    strings:
        $login_path = "/login"
        $username_param = "username="
        $response_diff = "Invalid username" or "Invalid password"
    condition:
        # of ($login_path) > 0 and # of ($username_param) > 0 and # of ($response_diff) > 0
}

Sigma Rule

title: CVE-2024-13028 Username Enumeration Attempt
id: cve-2024-13028
status: experimental
description: Detects multiple login attempts with different usernames
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/login'
    condition: selection | count(cs-username) by src_ip > 10
falsepositives:
    - Legitimate user testing multiple accounts
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13028 Username Enumeration Attempt"; flow:to_server; content:"POST"; http_method; content:"/login"; http_uri; content:"username="; http_client_body; threshold:type both, track by_src, count 10, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Implement generic error messages for login failures (e.g., "Invalid username or password").
2. Short-term: Apply rate limiting and CAPTCHA on the /login endpoint.
3. Long-term: Monitor for patches from Antabot. If no patch is released, consider replacing White-Jotter with a maintained alternative.
4. Detection: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence