Executive brief
The Lounge is a self-hosted web-based IRC client. The application's identd service on port 113 improperly discloses IRC usernames (idents) without properly validating connection addresses, allowing attackers to enumerate all active user accounts by scanning common port ranges. This information leakage could enable account enumeration and reconnaissance attacks.
Technical details
The vulnerability exists in The Lounge's identd (RFC 1413) implementation on port 113. The identd server fails to validate the connection address when responding to ident queries, only tracking local port numbers. Because multiple connections can share the same local port (when source addresses differ), the ident returns the username from the first connection for all subsequent queries on that port, and because remote addresses/ports are predictable (typically 6667 or 6697 for IRC), an attacker can trivially scan the local port range to enumerate all connected usernames. The issue is resolved in version 4.5.0, with fixes merged in PR #4872. Mitigation includes disabling identd or upgrading to the patched version.
Affected products
- The Lounge The Lounge before 4.5.0
Timeline
- 2024-05-09: disclosed
- 2024-05-12: patched: Fix merged in PR #4872