CVE-2024-33856
📋 TL;DR
This vulnerability in Logpoint allows attackers to enumerate valid usernames by timing responses from the Forgot Password endpoint. Attackers can identify which usernames exist in the system, facilitating targeted attacks. All Logpoint installations before version 7.4.0 are affected.
💻 Affected Systems
- Logpoint
📦 What is this software?
Siem by Logpoint
⚠️ Risk & Real-World Impact
Worst Case
Attackers build a complete list of valid usernames, enabling targeted credential stuffing, phishing, or brute-force attacks against specific accounts.
Likely Case
Attackers identify some valid usernames and use them for targeted social engineering or credential attacks.
If Mitigated
Attackers cannot reliably determine which usernames exist, limiting their ability to target specific accounts.
🎯 Exploit Status
Exploitation requires only web access and timing measurements; no authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.4.0
Vendor Advisory: https://servicedesk.logpoint.com/hc/en-us/articles/18533583876253-Username-enumeration-using-the-forget-password-endpoint
Restart Required: Yes
Instructions:
1. Backup your Logpoint configuration. 2. Upgrade to Logpoint version 7.4.0 or later. 3. Restart the Logpoint services.
🔧 Temporary Workarounds
Rate Limit Forgot Password Endpoint
allImplement rate limiting on the Forgot Password endpoint to make timing attacks impractical.
Disable Forgot Password Functionality
allTemporarily disable the Forgot Password feature if not essential.
🧯 If You Can't Patch
- Implement network-level controls to restrict access to the Forgot Password endpoint.
- Monitor for unusual patterns of requests to the Forgot Password endpoint.
🔍 How to Verify
Check if Vulnerable:
Test the Forgot Password endpoint with valid and invalid usernames; if response times differ significantly, the system is vulnerable.Check Version:
Check Logpoint web interface or run: logpoint-versionVerify Fix Applied:
After patching, test the Forgot Password endpoint; response times should be consistent regardless of username validity.📡 Detection & Monitoring
Log Indicators:
- Multiple failed Forgot Password attempts from single IP
- Unusual patterns of Forgot Password requests
Network Indicators:
- High volume of POST requests to /forgot-password endpoint
SIEM Query:
source="logpoint" AND (uri_path="/forgot-password" OR action="password_reset") | stats count by src_ip🔗 References
- https://servicedesk.logpoint.com/hc/en-us/articles/18533583876253-Username-enumeration-using-the-forget-password-endpoint
- https://servicedesk.logpoint.com/hc/en-us/categories/200832975-Knowledge-Center
- https://servicedesk.logpoint.com/hc/en-us/articles/18533583876253-Username-enumeration-using-the-forget-password-endpoint
- https://servicedesk.logpoint.com/hc/en-us/categories/200832975-Knowledge-Center
