CVE-2022-39315: 
PHP vulnerability analysis and mitigation

Kirby Content Management System was affected by a user enumeration vulnerability (CVE-2022-39315) discovered in versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1. The vulnerability affected all Kirby sites with user accounts unless Kirby's API and Panel were disabled in the config. The issue was discovered and disclosed in October 2022, with patches released on October 18, 2022 (GitHub Advisory).

The vulnerability was caused by a response discrepancy in Kirby's brute force protection system. The system would insert a random delay between one millisecond and two seconds after failed login attempts, but this delay was not inserted after the brute force limit was reached. The vulnerability could be exploited by creating login requests beyond the trials limit (10 by default) from multiple IP addresses. The CVSS score was rated as 6.5 (Medium) with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (GitHub Advisory).

The vulnerability allowed attackers to confirm which users were registered in a Kirby installation. This information could be exploited for social engineering attacks against users of the site or to discover the organizational structure of the company. The attack was limited to targeted attacks as it did not scale to brute force due to the delay during the first 10 requests per user and the subtle difference between responses for valid and invalid users (GitHub Advisory).

The vulnerability was patched in versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1. The fix involved rewriting the affected code so that the delay is also inserted after the brute force limit is reached. Users are advised to update to one of these or later versions to address the vulnerability. Additionally, disabling Kirby's API and Panel in the config could prevent exploitation (GitHub Advisory).

The vulnerability was responsibly reported by Florian Merz (@florianmrz) of hatchery.io. The GitHub release announcements for the patched versions received positive reactions from the community, with multiple users acknowledging the security updates (GitHub Releases).