CVE-2019-25338: DokuWiki Username Enumeration Vulnerability

CVE-2019-25338 Overview

CVE-2019-25338 is a username enumeration vulnerability affecting DokuWiki 2018-04-22b. The vulnerability exists in the password reset functionality, allowing attackers to identify valid user accounts within the system. By submitting different usernames to the password reset endpoint, attackers can distinguish between existing and non-existing accounts by analyzing the server's error response messages.

This type of information disclosure vulnerability (CWE-204: Observable Response Discrepancy) enables reconnaissance activities that can facilitate subsequent attacks such as credential stuffing, brute force password attacks, or targeted phishing campaigns against confirmed valid users.

Critical Impact

Attackers can enumerate valid usernames through the password reset functionality, enabling targeted attacks against confirmed user accounts.

Affected Products

• DokuWiki 2018-04-22b

Discovery Timeline

• 2026-02-12 - CVE-2019-25338 published to NVD
• 2026-02-12 - Last updated in NVD database

Technical Details for CVE-2019-25338

Vulnerability Analysis

The vulnerability stems from improper information handling in DokuWiki's password reset mechanism. When a user initiates a password reset request, the application returns different error messages depending on whether the submitted username exists in the system or not. This behavioral difference creates an oracle that attackers can exploit to enumerate valid accounts.

The password reset endpoint does not implement proper response normalization, meaning the server's behavior varies observably based on the validity of the username provided. This allows an unauthenticated attacker with network access to systematically probe the system and build a list of valid user accounts.

The network-based attack vector requires no authentication or user interaction, making it straightforward to automate. While the direct impact is limited to information disclosure (specifically, confirmation of valid usernames), this information serves as a valuable precursor for more damaging attacks.

Root Cause

The root cause is an observable response discrepancy (CWE-204) in the password reset functionality. The application fails to normalize its responses when processing password reset requests, allowing attackers to infer whether a username exists based on differences in error messages, response timing, or other observable behaviors.

Secure implementations should return identical responses regardless of whether the username exists, preventing attackers from distinguishing between valid and invalid accounts.

Attack Vector

The attack is conducted over the network without requiring any authentication. An attacker can interact with the password reset endpoint by submitting HTTP requests with different usernames. The methodology involves:

1. Sending a password reset request with a known invalid username and recording the response
2. Sending password reset requests with candidate usernames from a wordlist
3. Comparing responses to identify which usernames return different messages, indicating valid accounts

The attack can be easily automated using scripting tools or security testing frameworks. An exploit is publicly available on Exploit-DB #47731 that demonstrates this enumeration technique.

Detection Methods for CVE-2019-25338

Indicators of Compromise

• High volume of password reset requests from a single IP address or limited range of IPs
• Sequential or systematic username submissions to the password reset endpoint
• Unusual patterns of failed password reset attempts with different usernames
• Requests containing common username wordlists or dictionary patterns

Detection Strategies

• Monitor web server access logs for repeated POST requests to the password reset endpoint
• Implement rate limiting detection to identify enumeration attempts that exceed normal thresholds
• Configure SIEM rules to alert on multiple password reset attempts from the same source within a short timeframe
• Deploy web application firewall (WAF) rules to detect and block username enumeration patterns

Monitoring Recommendations

• Enable detailed logging for authentication and password reset endpoints
• Set up alerts for anomalous activity patterns on the password reset functionality
• Monitor for automated tool signatures in User-Agent strings or request patterns
• Review logs regularly for reconnaissance activity that may precede more serious attacks

How to Mitigate CVE-2019-25338

Immediate Actions Required

• Upgrade DokuWiki to a version that addresses this vulnerability
• Implement rate limiting on the password reset endpoint to slow enumeration attempts
• Consider adding CAPTCHA or other anti-automation controls to the password reset form
• Review and harden authentication-related configurations

Patch Information

Users should upgrade to a patched version of DokuWiki. The latest releases are available from the DokuWiki Download Page. Consult the VulnCheck DokuWiki Advisory for specific remediation guidance.

For more information about DokuWiki and its security updates, visit the DokuWiki Official Site.

Workarounds

• Implement a web application firewall (WAF) rule to normalize password reset responses
• Configure rate limiting at the reverse proxy or load balancer level to throttle password reset requests
• Add CAPTCHA to the password reset form to prevent automated enumeration
• Consider implementing account lockout policies that apply to password reset requests

# Example: Rate limiting configuration for nginx
# Add to server block to limit password reset requests
limit_req_zone $binary_remote_addr zone=password_reset:10m rate=5r/m;

location /doku.php {
    # Apply rate limiting to password reset requests
    limit_req zone=password_reset burst=2 nodelay;
}