Executive brief
vantage6 is an open-source framework for privacy-preserving federated learning. A vulnerability in its login system allows unauthorized users to determine if a specific username exists on the platform. By repeatedly attempting to log in with a potential username, an attacker can observe if the account becomes temporarily blocked, confirming the username's validity and potentially facilitating targeted credential-stuffing attacks.
Technical details
The vulnerability is classified as an Observable Response Discrepancy (CWE-204). While the application correctly returns generic error messages for failed login attempts to prevent simple enumeration, it implements a temporary account lockout policy after a specific number of failed attempts. An attacker can exploit this by submitting multiple failed login requests for a target username; if the account exists, it will eventually be blocked, creating a detectable change in system behavior or response timing compared to non-existent accounts. This allows for automated username harvesting via the network without prior authentication. The issue is resolved in version 3.8.0.
Affected products
- vantage6 vantage6 < 3.8.0
Timeline
- 2022-09-13: disclosed: CVE-2022-39228 assigned
- 2023-02-28: patched: Fix merged in version 3.8.0
- 2023-02-28: advisory
References
- https://github.com/vantage6/vantage6/security/advisories/GHSA-36gx-9q6h-g429
- https://github.com/vantage6/vantage6/issues/59
- https://github.com/vantage6/vantage6/pull/281
- https://github.com/vantage6/vantage6/commit/ab4381c35d24add06f75d5a8a284321f7a340bd2
- https://github.com/pypa/advisory-database/tree/main/vulns/vantage6/PYSEC-2023-52.yaml