CVE-2001-1013
published 2001-09-12CVE-2001-1013: Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory…
PriorityP335medium5CVSS 2.0
AVNACLAuNCPINAN
EXPLOIT
EPSS
65.56%
99.2th percentile
Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | linux | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect username enumeration attempts via HTTP GET requests to /~<username> paths; a 403 response ('You don't have permission') indicates a valid user without a public_html directory, while a 404 ('not found') indicates no such user. ↗
- →Monitor for sequential or high-volume HTTP GET requests matching the pattern /~<word> from a single source IP, indicative of automated username enumeration using a wordlist. ↗
- →Alert on HTTP responses containing the string 'permission' in reply to /~<username> requests, as the exploit script specifically sniffs for this keyword to confirm valid usernames. ↗
- ·The UserDir directive must be enabled in Apache for this vulnerability to be exploitable; it is disabled by default on Red Hat Enterprise Linux 5, 6, and 7. ↗
- ·Mitigation is possible without disabling UserDir entirely: configure httpd to return a single, uniform custom error code/page regardless of whether the username exists, eliminating the differential response that enables enumeration. ↗
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat5.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
CVE-2001-1013: Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html dir
vendor_redhat·CVSS 5.0
CVE-2001-1013 [MEDIUM] CVE-2001-1013: Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html dir
Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.
Statement: Red Hat does not consider this flaw to be a security issue. If UserDir is enabled, you can configure httpd to respond with a custom error page and a single error code whether the user exists or not.
The UserDir functionality is disabled by default in httpd on Red Hat Enterprise Linux 5, 6, and 7, and is thus not exposed on default installations.
GHSA
GHSA-ww47-4c2p-jhj9: Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html dir
ghsa_unreviewed·2022-04-30
CVE-2001-1013 [MEDIUM] GHSA-ww47-4c2p-jhj9: Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html dir
Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.
No detection rules found.
Exploit-DB
RedHat Linux 7.0 Apache - Remote Username Enumeration
exploitdb·2001-09-12
CVE-2001-1013 RedHat Linux 7.0 Apache - Remote Username Enumeration
RedHat Linux 7.0 Apache - Remote Username Enumeration
---
source: https://www.securityfocus.com/bid/3335/info
Versions of Apache webserver shipping with Red Hat Linux 7.0 (and possibly other Apache distributions) install with a default misconfiguration which could allow remote users to determine whether a give username exists on the vulnerable system.
http://www.example.com/~
When a remote user makes a request for a possible user's default home page, the server returns one of three responses:
In a case where is a valid user account, and has been configured with a homepage, the server responds with the user's homepage.
When exists on the system, but has not been assigned a homepage document, the server returns the message "You don't have permission to access /~username on this server
Metasploit
Apache "mod_userdir" User Enumeration
metasploit
Apache "mod_userdir" User Enumeration
Apache "mod_userdir" User Enumeration
Apache with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory and when the username does not exist, which could allow remote attackers to determine valid usernames on the server.
No writeups or analysis indexed.
http://archives.neohapsis.com/archives/vuln-dev/2000-q3/0083.htmlhttp://archives.neohapsis.com/archives/vuln-dev/2000-q3/0087.htmlhttp://archives.neohapsis.com/archives/vuln-dev/2000-q3/0094.htmlhttp://www.securityfocus.com/archive/1/213667http://www.securityfocus.com/bid/3335https://exchange.xforce.ibmcloud.com/vulnerabilities/7129http://archives.neohapsis.com/archives/vuln-dev/2000-q3/0083.htmlhttp://archives.neohapsis.com/archives/vuln-dev/2000-q3/0087.htmlhttp://archives.neohapsis.com/archives/vuln-dev/2000-q3/0094.htmlhttp://www.securityfocus.com/archive/1/213667http://www.securityfocus.com/bid/3335https://exchange.xforce.ibmcloud.com/vulnerabilities/7129
2001-09-12
Published