Information Exposure Through Timing Discrepancy in HedgeDoc - #VU165818

Vulnerability details

The vulnerability allows a remote attacker to determine whether an email address is registered at a HedgeDoc instance.

The vulnerability exists due to an observable timing discrepancy in the email login process when processing login attempts: unknown email addresses trigger an immediate return, while existing accounts require scrypt password verification. A remote attacker can submit login attempts and compare response times to identify registered email addresses, potentially using many source IP addresses to perform enumeration under the default rate limits.

Only instances with local email login enabled are affected; this is the default configuration, controlled by email or CMD_EMAIL.

Affected software

Remediation

External References

• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-cqg6-86p6-77jm

Related Security Bulletins

• Multiple vulnerabilities in HedgeDoc